PT-2023-29003 · Apache+1 · Apache Guacamole+1

Elttam + 2 · Publicado 2023-12-19 · Atualizado 2025-01-29 · CVE-2023-43826

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Guacamole versions 1.5.3 and older

Description The issue arises from inconsistent handling of values received from a VNC server, which can lead to integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Approximately 29,620 results are mainly distributed in the United States, Germany, and other countries.

Recommendations For Apache Guacamole versions 1.5.3 and older, upgrade to version 1.5.4, which fixes this issue. As a temporary workaround, consider restricting access to the VNC server to minimize the risk of exploitation. Avoid using potentially malicious or compromised VNC servers until the issue is resolved.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2023-8340

ALT-PU-2023-8341

ALT-PU-2024-16343

ALT-PU-2024-6761

ALT-PU-2024-8914

ALT-PU-2024-8918

ALT-PU-2025-2021

BIT-GUACAMOLE-2023-43826

BIT-GUACAMOLE-SERVER-2023-43826

CVE-2023-43826

Produtos afetados

Alt Linux

Apache Guacamole

Referências · 39

• https://lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6 · Aviso do Fabricante
• https://twitter.com/zoomeye_team/status/1737409031499899089 · Publicação no Twitter
• https://errata.altlinux.org/ALT-PU-2023-8341 · Aviso do Fabricante
• https://twitter.com/fridaysecurity/status/1737321827112743407 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-guacamole-server-2023-43826 · Aviso do Fabricante
• https://twitter.com/the_yellow_fall/status/1737317579633692803 · Publicação no Twitter
• https://errata.altlinux.org/ALT-PU-2024-6761 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-guacamole-2023-43826 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43826 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43999 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30576 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2023-8340 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2024-8914 · Aviso do Fabricante
• https://t.me/cvenotify/64267 · Publicação no Telegram
• https://errata.altlinux.org/ALT-PU-2024-16343 · Aviso do Fabricante