PT-2020-6265 · Unknown+9 · Libvncserver+9

Published 2020-08-26 · Updated 2022-10-29 · CVE-2020-25708

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibVNCServer version 0.9.12

Description The issue is related to a divide by zero problem in LibVNCServer, which can be exploited by a remote attacker to cause a denial of service. A malicious client can send a specially crafted message to the VNC server, leading to a floating point exception.

Recommendations For LibVNCServer version 0.9.12, consider disabling the service until a patch is available to prevent potential denial of service attacks. As a temporary workaround, restrict access to the VNC server to minimize the risk of exploitation.

Exploit

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALSA-2021:1811

ALT-PU-2020-2671

ALT-PU-2020-2694

BDU:2021-03737

CESA-2021_1811

CVE-2020-25708

DLA-2451-1

DLA-3125-1

MGASA-2020-0439

OPENSUSE-SU-2020:2025-1

OPENSUSE-SU-2020:2097-1

OPENSUSE-SU-2020_2025-1

OPENSUSE-SU-2020_2097-1

OPENSUSE-SU-2024:10598-1

RHSA-2021:1811

RHSA-2021_1811

RLSA-2021:1811

SUSE-SU-2020:14549-1

SUSE-SU-2020:3515-1

SUSE-SU-2020:3550-1

SUSE-SU-2020_14549-1

SUSE-SU-2020_3515-1

SUSE-SU-2020_3550-1

USN-4636-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Libvncserver

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 52

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1896739 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25708 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25708 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-1811.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3515-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2025-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3550-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:1811 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25708 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25708 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:1811 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14549-1 · Vendor Advisory