PT-2024-5229 · Tightvnc · Tightvnc

Published 2024-07-27 · Updated 2024-08-01 · CVE-2024-42049

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: TightVNC (Server for Windows) versions prior to 2.8.84

Description: The issue is related to the Control Pipe Handler component of the TightVNC remote desktop access system, which allows attackers to bypass the authentication procedure by using an alternative path or channel. This can enable a remote attacker to connect to the control pipe via a network connection without authorization.

Recommendations: For versions prior to 2.8.84, update to version 2.8.84 or later to resolve the issue. As a temporary workaround, consider restricting network access to the control pipe until a patch is applied.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Information Disclosure

Weakness Enumeration

CWE-288

CWE-200

Related Identifiers

BDU:2024-05795

CVE-2024-42049

Affected Products

Tightvnc

References · 9

• 🔥 https://exploit-db.com/exploits/52322 · Exploit
• https://bdu.fstec.ru/vul/2024-05795 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42049 · Security Note
• https://sourceforge.net/p/vnc-tight/bugs/1629 · Note
• https://feedly.com/cve/CVE-2024-42049 · Note
• https://tightvnc.com/whatsnew.php · Note
• https://t.me/cvenotify/87652 · Telegram Post
• https://vuldb.com/de/?id.272589 · Note
• https://t.me/cvedetector/1762 · Telegram Post