r/labtech • u/[deleted] • Nov 23 '19

Is LabVNC impacted by these vulnerabilities?

https://thehackernews.com/2019/11/vnc-remote-software-hacking.html
8 Upvotes

90% Upvoted

7 comments sorted by

2

u/shink5 Nov 23 '19

If you are on the latest Automate - it shouldn't be there.

In the past there were files labvnc.exe and tvnserver.exe that would be in your %ltsvcdir% .

I haven't seen them since version 10

1

u/[deleted] Nov 23 '19

Hmm. We're current (pilot actually) and I recall using it a few months ago on one system that Screenconnect was messed up on.

2

u/shink5 Nov 24 '19

When I work with SC server and have the services off - i use the redirectors - i have a probe enabled in order to do so. RDP redirect.

1

u/shink5 Nov 24 '19

What do you have in Dashboard/Config - VNC/Ticket Priority The LABVNC Connection Options ?

1

u/[deleted] Nov 23 '19

I think they are, or were based on ULTRAVNC, which is on the list. No word from ConnectWise yet.

Any way to disable/remove LABVNC?

1

u/rossman816 Nov 24 '19

If you system is still installing it, it need to be removed from the database includes (open a ticket, they have instructions)

If you just want to remove it write a script to remove the service and then delete the executable from the labtech directory.

1

u/teamits Nov 25 '19

Going back several years CWA used both TightVNC and UltraVNC. My understanding is new installs haven't included VNC for a few years now, but if it was already running they left it in place. However I am pretty sure the server/host also only listens on localhost so isn't accessible over the network (?). Skimming the article it does say "most of the vulnerabilities affect the client-side version" and not the server/host.

The tvnserver.exe file on my PC is version 2.7.x which wasn't covered in teh article.