Vino UPnP Port Exposure Vulnerability - CVE-2011-1165
Summary
DEBIAN-CVE-2011-1165: Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attacke... Affects vino versions 3.22.0-6 – 3.22.0-7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vino is a remote desktop sharing application that allows users to connect to their desktops over a network. It is commonly used in Linux environments to facilitate remote access and support. The application is designed to work seamlessly with UPnP (Universal Plug and Play) routers, enabling automatic configuration for incoming connections. However, this feature can inadvertently expose users to security risks if not properly documented and managed.
Vulnerability Detail
The vulnerability identified as CVE-2011-1165 in Vino arises from inadequate documentation regarding its UPnP functionality. Specifically, when the 'Configure network to automatically accept connections' setting is enabled, Vino opens ports on UPnP routers without clear user awareness. This lack of transparency can lead to unauthorized access, allowing remote attackers to exploit the open ports for further malicious activities. The vulnerability is particularly concerning as it may expose sensitive user data and system resources to potential threats.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the 'Configure network to automatically accept connections' setting in Vino's preferences. This will prevent the application from opening ports on the router, thereby reducing the risk of unauthorized access.
Conclusion
The CVE-2011-1165 vulnerability in Vino highlights the importance of proper documentation and user awareness regarding UPnP functionalities. Users are encouraged to update their Vino installations and consider disabling automatic port configuration to enhance security.
See every vulnerability recorded for vino →
FAQ
CVE-2011-1165 is a vulnerability in the Vino remote desktop sharing application that allows it to open ports on UPnP routers without proper user documentation.
This vulnerability can expose your system to remote attacks by allowing unauthorized access through open ports on your router.
You should update to the latest version of Vino to ensure that the vulnerability is patched and your system is secure.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Vulert is a tool that helps monitor and alert for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for vino.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
