PT-2022-16372 · Tightvnc · Tightvnc

Published 2022-01-26 · Updated 2022-12-28 · CVE-2022-23967

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TightVNC version 1.3.10

Description The issue is caused by an integer signedness error and a resultant heap-based buffer overflow in the InitialiseRFBConnection function in rfbproto.c, which is part of the vncviewer component. This error occurs because there is no check on the size given to malloc, allowing for the allocation of a chunk of size zero, which can provide a heap pointer. An attacker can send a large amount of data, specifically 0xffffffff bytes, which can lead to a denial of service (DoS) or potentially allow for remote code execution.

Recommendations For TightVNC version 1.3.10, as a temporary workaround, consider disabling the InitialiseRFBConnection function in rfbproto.c until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-23967

Affected Products

Tightvnc

References · 9

• 🔥 https://github.com/MaherAzzouzi/CVE-2022-23967 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23967 · Security Note
• https://ubuntu.com/security/CVE-2022-23967 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23967 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23967 · Vendor Advisory
• https://github.com/456478/evilginx.botguard · Note
• https://t.me/cibsecurity/36358 · Telegram Post
• https://tightvnc.com/licensing-server-x11.php · Note
• https://t.me/cybersecuritytechnologies/5297 · Telegram Post