PT-2009-3044 · Ultravnc+1 · Ultravnc+1

Andres Lopez Luksenberg · Publicado 2009-02-04 · Atualizado 2018-10-11 · CVE-2009-0388

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UltraVNC versions 1.0.2 through 1.0.5 TightVnc version 1.3.9

Description The issue is related to multiple integer signedness errors that can be exploited by remote VNC servers. This can lead to a denial of service, resulting in heap corruption and application crash, or possibly allow the execution of arbitrary code. The errors are related to the ClientConnection::CheckBufferSize and ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp. A large length value in a message can trigger this issue.

Recommendations For UltraVNC versions 1.0.2 through 1.0.5, consider disabling the ClientConnection::CheckBufferSize and ClientConnection::CheckFileZipBufferSize functions until a patch is available. For TightVnc version 1.3.9, restrict access to the ClientConnection.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-0388

Produtos afetados

Tightvnc

Ultravnc

Referências · 11

• 🔥 https://exploit-db.com/exploits/7990 · Exploit
• 🔥 http://coresecurity.com/content/vnc-integer-overflows · Exploit
• 🔥 https://exploit-db.com/exploits/8024 · Exploit
• 🔥 http://securityfocus.com/bid/33568 · Exploit
• http://forum.ultravnc.info/viewtopic.php?t=14654 · Nota
• http://vupen.com/english/advisories/2009/0322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0388 · Nota de Segurança
• http://securityfocus.com/archive/1/500632/100/0/threaded · Nota
• http://vupen.com/english/advisories/2009/0321 · Nota
• http://secunia.com/advisories/33807 · Nota
• http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564 · Nota