There is a vnc security fix available (nc-3.3.3r2-436), but there's a pending
vulnerability not fixed:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple
connections, which allows remote attackers to bypass VNC authentication by
sniffing the challenge and response of other users.

Patch:

diff -ur vnc_unixsrc-orig/libvncauth/vncauth.c vnc_unixsrc/libvncauth/vncauth.c
--- vnc_unixsrc-orig/libvncauth/vncauth.c       Thu Apr 29 07:39:15 1999
+++ vnc_unixsrc/libvncauth/vncauth.c    Fri Apr 25 17:03:33 2003
@@ -124,9 +124,15 @@
 vncRandomBytes(unsigned char *bytes)
 {
     int i;
-    unsigned int seed = (unsigned int) time(0);
+    unsigned int seed;
+    static int s_srandom_called = 0;
+
+    if (!s_srandom_called) {
+      seed = (unsigned int)time(0) ^ (unsigned int)getpid();
+      srandom(seed);
+      s_srandom_called = 1;
+    }

-    srandom(seed);
     for (i = 0; i < CHALLENGESIZE; i++) {
        bytes[i] = (unsigned char)(random() & 255);
     }