Bug#637386: vnc4server: blacklists wrong IP: 0.0.0.0, can lead to DoS

[Mitch Deoudes]

Apparently, this is still an issue as of Xvnc 4.1.1.  (Up to date on 
Linux Mint / Ubuntu.)

Last week, I started getting vnc password attempts from an unknown IP, 
resulting in the "blacklisted: 0.0.0.0" messages in the log, and the 
server refusing all connections.

I would prefer not to disable blacklisting, as that just gives the 
attacker a free hand to try and brute-force my password all day. (And it 
seems that there's no way to use an encryption key instead of a password?)

Is there any other way to determine the actual IP of the attacker? I 
could set up a fail2ban jail for vnc, if I could get that info from some 
other log.

mitch