CVE-2006-2369

Name	CVE-2006-2369
Description	RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vnc4 (PTS)	jessie	4.1.1+X4.3.0-37.6	fixed
	buster, stretch	4.1.1+X4.3.0+t-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vnc4	source	sarge	(not affected)
vnc4	source	(unstable)	4.1.1+X4.3.0-10	high

[sarge] - vnc4 <not-affected> (vuln not in 4.0)