PT-2019-4938 · Ultravnc · Ultravnc

Published 2019-03-05 · Updated 2021-06-28 · CVE-2019-8264

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UltraVNC version 1203

Description The issue is related to an out-of-bounds access vulnerability in the VNC client inside the Ultra2 decoder. This can potentially result in code execution and appears to be exploitable via network connectivity.

Recommendations For UltraVNC version 1203, update to revision 1204 to resolve the issue.

Fix

Access of Memory Location After End of Buffer

Memory Corruption

Out of bounds Read

Weakness Enumeration

CWE-788

CWE-787

CWE-125

Related Identifiers

BDU:2020-01546

CVE-2019-8264

Affected Products

Ultravnc

References · 11

• https://osv.dev/vulnerability/CVE-2019-8264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8264 · Security Note
• https://bdu.fstec.ru/vul/2020-01546 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf · Note
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-011-ultravnc-access-of-memory-location-after-end-of-buffer · Note
• https://us-cert.gov/ics/advisories/icsa-20-161-06 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-05-TelevisGO_Security_Notification.pdf&p_Doc_Ref=SEVD-2019-225-05 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-05-TelevisGO_Security_Notification.pdf&p_Doc_Ref=SEVD-2019-225-05 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf · Note