Password Bug in RealVNC 3.3.7

While tracking down other horrible things I stumbled on a bug that I think others should know about (if you don't know already).

ISSUE:
==============================================
VNC Server cuts off passwords during auth at 8 characters. So, if you set a 24 char password, all I have to do is guess the first 8 and I own your server.

VERSION INFO:
==============================================
RealVNC 3.3.7

PLATFORMS TESTED:
==============================================
All Win32


I'll report this to the fine folks at RealVNC, but I threw it up here first...

--TH13

Does this go for TightVNC as well?

I've only tried this on RealVNC. I don't use TightVNC.

to add insult to injury go to HKEY_CURRENT_USER\software\orl\winvnc\password

or HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default

very easy to de-crypt

im sure they know its been this way for some time

That is why you run it through SSH.

VNC should where possible be tunneled via SSH using keypair auth. Unfortunately it's not always practical to do so, so you may have to settle for allowing logins from a restricted IP range. ;)

Yeah, I typically use stunnel for all of my needs (on W32 machines). Otherwise, SSH is the only way I fly. In this case, I found the problem on another group's server. The apes seem incapable of getting stunnel setup so they run VNC outright.