Buffer overflow in LibVNCServer - CVE-2019-20840

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU29372

Buffer overflow in LibVNCServer - CVE-2019-20840

Published: June 30, 2020


Vulnerability identifier: #VU29372
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-20840
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within hybiReadAndDecode() in libvncserver/ws_decode.c. A remote attacker can create a specially crafted request to the affected LibVNCServer installation and crash the service.


Affected software

LibVNCServer
libvncserver (Alpine package)
libvncclient1 (Ubuntu package)
libvncserver1 (Ubuntu package)
libvncserver
Opensuse
Ubuntu
Fedora
SIMATIC ITC2200 PRO
SIMATIC ITC2200
SIMATIC ITC1900 PRO
SIMATIC ITC1900
SIMATIC ITC1500 PRO
SIMATIC ITC1500

How to mitigate CVE-2019-20840

Install updates from vendor's website.

LibVNCServer - update to 0.9.13
libvncserver (Alpine package) - update to 0.9.13-r0
SIMATIC ITC2200 PRO - update to
libvncclient1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.5, 0.9.11+dfsg-1ubuntu1.3, 0.9.12+dfsg-9ubuntu0.2
libvncserver1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.5, 0.9.11+dfsg-1ubuntu1.3, 0.9.12+dfsg-9ubuntu0.2
libvncserver - update to 0.9.13-2.fc32
SIMATIC ITC2200 PRO - update to 3.2.1.0
SIMATIC ITC2200 - update to 3.2.1.0
SIMATIC ITC1900 PRO - update to 3.2.1.0
SIMATIC ITC1900 - update to 3.2.1.0
SIMATIC ITC1500 PRO - update to 3.2.1.0
SIMATIC ITC1500 - update to 3.2.1.0

External References

Related Security Bulletins