PT-2019-5437 · Libvnc+5 · Libvncserver+5

Published 2019-12-18 · Updated 2022-03-10 · CVE-2020-14398

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibVNCServer versions prior to 0.9.13

Description The issue is related to an infinite loop in the libvncclient/sockets.c component of the LibVNCServer library. This occurs due to an improperly closed TCP connection, which can be exploited by a remote attacker to cause a denial of service. The exploitation may result from the incorrect closure of a TCP connection, leading to the infinite loop.

Recommendations For versions prior to 0.9.13, update to version 0.9.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the libvncclient/sockets.c component to minimize the risk of exploitation.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2020-2671

ALT-PU-2020-2694

BDU:2020-03158

CVE-2020-14398

MGASA-2020-0280

OPENSUSE-SU-2020:0988-1

OPENSUSE-SU-2020:1025-1

OPENSUSE-SU-2020:1056-1

OPENSUSE-SU-2020_0988-1

OPENSUSE-SU-2020_1025-1

OPENSUSE-SU-2020_1056-1

OPENSUSE-SU-2024:10598-1

SUSE-SU-2020:14424-1

SUSE-SU-2020:1922-1

SUSE-SU-2020:2167-1

USN-4434-1

Affected Products

Alt Linux

Astra Linux

Libvncserver

Linuxmint

Suse

Ubuntu

References · 71

• https://github.com/LibVNC/libvncserver/commit/57433015f856cc12753378254ce4f1c78f5d9c7b · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03158 · Security Note
• https://ubuntu.com/security/CVE-2020-14405 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14398 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14424-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2167-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14398 · Security Note
• https://ubuntu.com/security/CVE-2020-14402 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1922-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14399 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf · Patch
• https://ubuntu.com/security/CVE-2020-14397 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14404 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14398 · Vendor Advisory