PT-2023-29003 · Apache+1 · Apache Guacamole+1

Elttam + 2 · Published 2023-12-19 · Updated 2025-01-29 · CVE-2023-43826

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Guacamole versions 1.5.3 and older

Description The issue arises from inconsistent handling of values received from a VNC server, which can lead to integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Approximately 29,620 results are mainly distributed in the United States, Germany, and other countries.

Recommendations For Apache Guacamole versions 1.5.3 and older, upgrade to version 1.5.4, which fixes this issue. As a temporary workaround, consider restricting access to the VNC server to minimize the risk of exploitation. Avoid using potentially malicious or compromised VNC servers until the issue is resolved.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2023-8340

ALT-PU-2023-8341

ALT-PU-2024-16343

ALT-PU-2024-6761

ALT-PU-2024-8914

ALT-PU-2024-8918

ALT-PU-2025-2021

BIT-GUACAMOLE-2023-43826

BIT-GUACAMOLE-SERVER-2023-43826

CVE-2023-43826

Affected Products

Alt Linux

Apache Guacamole

References · 39

• https://lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-8341 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-guacamole-server-2023-43826 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-6761 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-guacamole-2023-43826 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43826 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43999 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30576 · Security Note
• https://errata.altlinux.org/ALT-PU-2023-8340 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-8914 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-16343 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2025-2021 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41767 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-43826 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-43826 · Vendor Advisory