PT-2009-3044 · Ultravnc+1 · Ultravnc+1

Andres Lopez Luksenberg · Published 2009-02-04 · Updated 2018-10-11 · CVE-2009-0388

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UltraVNC versions 1.0.2 through 1.0.5 TightVnc version 1.3.9

Description The issue is related to multiple integer signedness errors that can be exploited by remote VNC servers. This can lead to a denial of service, resulting in heap corruption and application crash, or possibly allow the execution of arbitrary code. The errors are related to the ClientConnection::CheckBufferSize and ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp. A large length value in a message can trigger this issue.

Recommendations For UltraVNC versions 1.0.2 through 1.0.5, consider disabling the ClientConnection::CheckBufferSize and ClientConnection::CheckFileZipBufferSize functions until a patch is available. For TightVnc version 1.3.9, restrict access to the ClientConnection.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0388

Affected Products

Tightvnc

Ultravnc

References · 11

• 🔥 https://exploit-db.com/exploits/7990 · Exploit
• 🔥 http://coresecurity.com/content/vnc-integer-overflows · Exploit
• 🔥 https://exploit-db.com/exploits/8024 · Exploit
• 🔥 http://securityfocus.com/bid/33568 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0388 · Security Note
• http://forum.ultravnc.info/viewtopic.php?t=14654 · Note
• http://vupen.com/english/advisories/2009/0322 · Note
• http://securityfocus.com/archive/1/500632/100/0/threaded · Note
• http://vupen.com/english/advisories/2009/0321 · Note
• http://secunia.com/advisories/33807 · Note
• http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564 · Note