PT-2019-4938 · Ultravnc · Ultravnc

Publicado 2019-03-05 · Atualizado 2021-06-28 · CVE-2019-8264

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UltraVNC version 1203

Description The issue is related to an out-of-bounds access vulnerability in the VNC client inside the Ultra2 decoder. This can potentially result in code execution and appears to be exploitable via network connectivity.

Recommendations For UltraVNC version 1203, update to revision 1204 to resolve the issue.

Correção

Access of Memory Location After End of Buffer

Memory Corruption

Out of bounds Read

Enumeração de Fraquezas

CWE-788

CWE-787

CWE-125

Identificadores relacionados

BDU:2020-01546

CVE-2019-8264

Produtos afetados

Ultravnc

Referências · 11

• https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf · Nota
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf · Nota
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-011-ultravnc-access-of-memory-location-after-end-of-buffer · Nota
• https://osv.dev/vulnerability/CVE-2019-8264 · Aviso do Fabricante
• https://us-cert.gov/ics/advisories/icsa-20-161-06 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-8264 · Nota de Segurança
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-05-TelevisGO_Security_Notification.pdf&p_Doc_Ref=SEVD-2019-225-05 · Nota
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-05-TelevisGO_Security_Notification.pdf&p_Doc_Ref=SEVD-2019-225-05 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf · Nota
• https://bdu.fstec.ru/vul/2020-01546 · Nota de Segurança