So what can be done about this exploit? Does 4.1.2 protect against this vulnerability? And what other mitigation procedures are available for this?
Well, VNC hasn't exactly been legendary for security .. but if you do run it, one safe(er) way to do so is bind VNC to localhost, and use sshd and port-redirection to access it.
Of course, then you've got to pay attention to patches in OpenSSH, but that's got a better track record, and allows you to do RSA auth, etc.
Cheers, Michael Holstein CISSP GCIA Cleveland State University _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/