Memory leak in LibVNCServer - CVE-2019-15681

Vulnerability identifier: #VU22957

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15681

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due memory leak in VNC server code. A remote attacker can read stack memory and disclose sensitive information.

Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.

LibVNCServer
Opensuse
Ubuntu
SIMATIC ITC2200 PRO
SIMATIC ITC1900
SIMATIC ITC1500 PRO
SIMATIC ITC1500
SIMATIC ITC1900 PRO
SIMATIC ITC2200
libvncserver1 (Ubuntu package)
libvncclient1 (Ubuntu package)
cabextract (Alpine package)
italc-client (Ubuntu package)
italc-master (Ubuntu package)
libitalccore (Ubuntu package)

Install update from vendor's website.

LibVNCServer - update to 0.9.13
SIMATIC ITC2200 PRO - update to
libvncserver1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.4, 0.9.11+dfsg-1.3ubuntu0.1, 0.9.11+dfsg-1ubuntu1.2, 0.9.12+dfsg-9ubuntu0.1
libvncclient1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.4, 0.9.11+dfsg-1.3ubuntu0.1, 0.9.11+dfsg-1ubuntu1.2, 0.9.12+dfsg-9ubuntu0.1
cabextract (Alpine package) - update to 1.9.1-r0
italc-client (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1
italc-master (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1
libitalccore (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1
SIMATIC ITC1900 - update to 3.2.1.0
SIMATIC ITC1500 PRO - update to 3.2.1.0
SIMATIC ITC1500 - update to 3.2.1.0
SIMATIC ITC1900 PRO - update to 3.2.1.0
SIMATIC ITC2200 - update to 3.2.1.0
SIMATIC ITC2200 PRO - update to 3.2.1.0

• https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
• https://ics-cert.kaspersky.com/reports/2019/11/22/vnc-vulnerability-research/
• https://lists.debian.org/debian-lts-announce/2019/10/msg00039.html
• https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html

• Information disclosure in LibVNC
• OpenSUSE Linux update for vino
• OpenSUSE Linux update for LibVNCServer
• Memory leak in cabextract (Alpine package)
• Multiple vulnerabilities in Siemens SIMATIC ITC
• Ubuntu update for libvncserver
• Ubuntu update for italc