PT-2016-3302 · Libvncserver Team+3 · Libvncserver+3
Josef Gajdusek
·
Publicado
2016-11-24
·
Atualizado
2020-10-23
·
CVE-2016-9941
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LibVNCServer versions prior to 0.9.11
Description
The issue is related to a heap-based buffer overflow in the rfbproto.c component of LibVNCServer, which can be exploited by remote servers. This can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The vulnerability is triggered by a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.
Recommendations
For versions prior to 0.9.11, update to version 0.9.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the
rfbproto.c component or limiting the handling of FramebufferUpdate messages to minimize the risk of exploitation.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Libvncserver
Suse
Ubuntu