13882.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
13882

--
Summary:
This event is generated when network traffic that indicates RealVNC Server is configured not to require authentication and is being used.

--
Impact:
Possible policy violation. The use of RealVNC Server may be prohibited by corporate policy in some network environments. 

--
Detailed Information:
This event indicates that the RealVNC Server running on a host is configured not to require authentication and is being used on the protected network.

--
Affected Systems:
All systems using RealVNC Server when configured not to require authentication

--
Attack Scenarios:
This is a possible policy violation, it may be that RealVNC Server has been installated on a client host.

--
Ease of Attack:
Simple.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Disallow the use of RealVNC Server on the protected network and enforce or implement an organization wide policy on the use of RealVNC Server configured not to require authentication.

Reconfigure RealVNC Server to use authentication.

--
Contributors:
Sourcefire Vulnerability Research Team


--
Additional References:

--