Out-of-bounds write in LibVNCServer - CVE-2017-18922

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30157

Out-of-bounds write in LibVNCServer - CVE-2017-18922

Published: June 30, 2020 / Updated: July 17, 2020


Vulnerability identifier: #VU30157
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18922
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.


Affected software

LibVNCServer
libvncserver (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
libvncserver1 (Ubuntu package)
libvncclient1 (Ubuntu package)
libvncserver
CentOS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Opensuse
Ubuntu
Fedora
SIMATIC ITC2200 PRO
SIMATIC ITC1500
SIMATIC ITC1500 PRO
SIMATIC ITC1900
SIMATIC ITC1900 PRO
SIMATIC ITC2200

How to mitigate CVE-2017-18922

Install update from vendor's website.

LibVNCServer - update to 0.9.12
libvncserver (Red Hat package) - addressed in versions 0.9.9-14.el7_8.1, 0.9.11-9.el8_0.3, 0.9.11-9.el8_1.3, 0.9.11-15.el8_2.1
SIMATIC ITC2200 PRO - update to
libvncserver1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.4, 0.9.11+dfsg-1.3ubuntu0.1, 0.9.11+dfsg-1ubuntu1.2, 0.9.12+dfsg-9ubuntu0.1
libvncclient1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.4, 0.9.11+dfsg-1.3ubuntu0.1, 0.9.11+dfsg-1ubuntu1.2, 0.9.12+dfsg-9ubuntu0.1
libvncserver - addressed in versions 0.9.13-2.fc31, 0.9.13-2.fc32
SIMATIC ITC1500 - update to 3.2.1.0
SIMATIC ITC1500 PRO - update to 3.2.1.0
SIMATIC ITC1900 - update to 3.2.1.0
SIMATIC ITC1900 PRO - update to 3.2.1.0
SIMATIC ITC2200 - update to 3.2.1.0
SIMATIC ITC2200 PRO - update to 3.2.1.0

External References

Related Security Bulletins