CVEvulnerability

CVE-2002-0971

4.6 MEDIUM Published 2002-09-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2002-09-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P

Description

Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.

Affected configurations

• att winvnc server (<= 3.3.3 r9) • att winvnc server 3.3.3 r7 • tightvnc tightvnc 1.2.0 • tightvnc tightvnc 1.2.1 • tightvnc tightvnc 1.2.5 • tridia tridiavnc 1.5 • tridia tridiavnc 1.5.1 • tridia tridiavnc 1.5.2 • tridia tridiavnc 1.5.4

Related

Referenced by CWE · observed example (1)

  • CWE-422 Unprotected Windows Messaging Channel weakness

References