PT-2009-1012 · Realvnc+1 · Realvnc Vnc Free Edition+4

Published 2009-01-16 · Updated 2022-06-10 · CVE-2008-4770

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealVNC VNC Free Edition versions 4.0 through 4.1.2 RealVNC VNC Enterprise Edition versions E4.0 through E4.4.2 RealVNC VNC Personal Edition versions P4.0 through P4.4.2

Description The issue allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type." This is due to a problem in the CMsgReader::readRect function in the VNC Viewer component. The vulnerability can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For RealVNC VNC Free Edition versions 4.0 through 4.1.2, update to a version outside of this range to resolve the issue. For RealVNC VNC Enterprise Edition versions E4.0 through E4.4.2, update to a version outside of this range to resolve the issue. For RealVNC VNC Personal Edition versions P4.0 through P4.4.2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the VNC Viewer component until a patch is available.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-20

CWE-284

Related Identifiers

BDU:2015-02031

BDU:2022-06447

CVE-2008-4770

DSA-1716-1

RHSA-2009:0261

RHSA-2009_0261

Affected Products

Realvnc Vnc Enterprise Edition

Realvnc Vnc Free Edition

Realvnc Vnc Personal Edition

Red Hat

Vnc Viewer

References · 27

• https://bdu.fstec.ru/vul/2015-02031 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4770 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-January/msg01025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4770 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1 · Vendor Advisory
• http://realvnc.com/products/upgrade.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0261.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200903-17.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-4770 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06447 · Security Note
• https://access.redhat.com/security/cve/CVE-2008-4770 · Note
• http://debian.org/security/dsa-1716 · Note
• http://securityfocus.com/bid/31832 · Note
• http://vupen.com/english/advisories/2008/2868 · Note