Debian update for libvncserver



Published: 2019-02-04 | Updated: 2019-02-11
Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2018-6307
CVE-2018-15126
CVE-2018-15127
CVE-2018-20019
CVE-2018-20020
CVE-2018-20021
CVE-2018-20022
CVE-2018-20023
CVE-2018-20024
CWE-ID CWE-416
CWE-787
CWE-835
CWE-401
CWE-476
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		libvncserver (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Heap use-after-free

EUVDB-ID: #VU17126

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-6307

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap use-after-free error in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU16962

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-15126

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a heap use-after-free error in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap out-of-bounds write

EUVDB-ID: #VU17122

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-15127

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Heap out-of-bounds write

EUVDB-ID: #VU17123

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20019

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Heap out-of-bounds write

EUVDB-ID: #VU17124

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20020

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in inside structure in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Infinite loop

EUVDB-ID: #VU17127

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20021

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in VNC client code. A remote attacker can consume excessive amount of resources like CPU and RAM and perform a denial of service (DoS) attack.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU17129

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20022

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU17128

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20023

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU17125

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20024

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in VNC client code. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected package to version: 0.9.11+dfsg-1.3~deb9u1.

Vulnerable software versions

libvncserver (Debian package): 0.9.9+dfsg2-6.1+deb8u1 - 0.9.11+dfsg-1+deb9u1

External links

http://www.debian.org/security/2019/dsa-4383


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###