SB2019030902 - Multiple vulnerabilities in UltraVNC

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019030902

SB2019030902 - Multiple vulnerabilities in UltraVNC

Published: March 9, 2019 Updated: November 27, 2019

Security Bulletin ID SB2019030902
Severity
Medium
Patch available
YES
Number of vulnerabilities 22
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 22 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2019-8280)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in VNC client inside RAW decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.


2) Improper Initialization (CVE-ID: CVE-2019-8277)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to an uninitialized read condition in VNC server code. A remote attacker can read stack memory and disclose sensitive information on the target system.

Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.


3) Stack-based buffer overflow (CVE-ID: CVE-2019-8276)

The vulnerability allows a remote attacker to perform a denial of service (DoS) on the target system.

The vulnerability exists due to a boundary error in VNC server code inside file transfer request handler. A remote authenticated attacker can trigger stack-based buffer overflow and cause a denial of service condition on the target system.


4) Improper Null Termination (CVE-ID: CVE-2019-8275)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists in VNC server code due to the affected software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.


5) Heap-based buffer overflow (CVE-ID: CVE-2019-8274)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC server code inside file transfer offer handler. A remote authenticated attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


6) Heap-based buffer overflow (CVE-ID: CVE-2019-8273)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC server code inside file transfer request handler. A remote authenticated attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


7) Off-by-one (CVE-ID: CVE-2019-8272)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error in VNC server code. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Heap-based buffer overflow (CVE-ID: CVE-2019-8271)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC server code inside file transfer handler. A remote authenticated attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Out-of-bounds read (CVE-ID: CVE-2019-8270)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to out-of-bounds read in VNC client code inside Ultra decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it and cause a denial of service condition on the target system.


10) Stack-based buffer overflow (CVE-ID: CVE-2019-8269)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in VNC client code inside FileTransfer module. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger stack-based buffer overflow and cause a denial of service condition on the target system.



11) Off-by-one (CVE-ID: CVE-2019-8268)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error in VNC client code connected with improper usage of "ClientConnection::ReadString" function. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


12) Out-of-bounds read (CVE-ID: CVE-2019-8267)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to out-of-bounds read in VNC client code inside TextChat module. A remote attacker that controls a malicious VNC server can trick a user to connect to it and perform a denial of service (DoS) attack.


13) Out-of-bounds write (CVE-ID: CVE-2019-8266)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error connected with improper usage of "ClientConnection::Copybuffer" function in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.


14) Out-of-bounds write (CVE-ID: CVE-2019-8265)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error connected with improper usage of SETPIXELS macro in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.


15) Out-of-bounds write (CVE-ID: CVE-2019-8264)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in VNC client inside Ultra2 decoder when processing untrusted input. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.


16) Stack-based buffer overflow (CVE-ID: CVE-2019-8263)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in VNC client code inside ShowConnInfo routine. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger stack-based buffer overflow and cause a denial of service condition on the target system.



17) Heap-based buffer overflow (CVE-ID: CVE-2019-8262)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC client code inside Ultra decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger heap-based buffer overflow and execute arbitrary code with privileges of the user, running the VNC client.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


18) Out-of-bounds read (CVE-ID: CVE-2019-8261)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a boundary condition in VNC code inside client CoRRE decoder, caused by multiplication overflow. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds read error and read contents of memory on the system.


19) Out-of-bounds read (CVE-ID: CVE-2019-8260)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a boundary condition in VNC client RRE decoder code, caused by multiplication overflow. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds read error and read contents of memory on the system.


20) Memory leak (CVE-ID: CVE-2019-8259)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due memory leak in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it and access sensitive information.

Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.


21) Heap-based buffer overflow (CVE-ID: CVE-2019-8258)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC client. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger heap-based buffer overflow and execute arbitrary code with privileges of the user, running the VNC client.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


22) Integer underflow (CVE-ID: CVE-2018-15361)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger integer underflow and execute arbitrary code on the target system with privileges of the user, running the VNC client.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References