Signature Detail

VNC: Invalid Client Request

This protocol anomaly triggers when it detects a VNC client request that is sent by a VNC server. VNC servers should receive VNC requests, not send them. Triggering this protocol anomaly can indicate that the VNC client is invalid, or that the VNC client is sending nested requests to the VNC server.

Extended Description

Detection of a VNC session initiation request originating from a VNC server may indicate that a software or network transmission error has occurred. It may also indicate that a malicious user is running a nested session in an attempt to bypass access control policies and/or mask a malicious user's true originating IP address.

References

• URL: http://www.realvnc.com/docs/rfbproto.pdf