CVE-2002-1511: Att Vnc

Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days.

The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies.

Affected products

• Att Vnc: version 3.3.3 only; version 3.3.3r2 only; version 3.3.4 only; version 3.3.5 only; version 3.3.6 only
• Tightvnc Tightvnc: version 1.2.0 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.4 only; version 1.2.5 only

Published 2003-03-03. Last modified 2026-06-16.