Heap-based buffer overflow in LibVNCServer - CVE-2016-9941

Vulnerability identifier: #VU3076

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9941

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on vulnerable client system.

A heap-based buffer overflow vulnerability exists due to boundary error in rfbproto.c in LibVNCClient software, which is bundled with LibVNCServer. A remote attacker can trick the victim to connect to malicious VNC server, send a specially crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area and trigger buffer overflow.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable VNC client.

LibVNCServer
Arch Linux
Gentoo Linux
SUSE Linux
Ubuntu
Fedora
libvncserver (Alpine package)
libvncserver

Update to version 0.9.11:
https://github.com/LibVNC/libvncserver/tree/LibVNCServer-0.9.11

libvncserver (Alpine package) - update to 0.9.10-r2
libvncserver - addressed in versions 0.9.11-2.fc24.1, 0.9.11-2.fc25.1, 0.9.11-2.fc26

• https://github.com/LibVNC/libvncserver/pull/137
• https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11

• Two heap-based buffer overflows in LibVNCClient
• Gentoo update for LibVNCServer/LibVNCClient
• Arch Linux update for libvncserver
• Ubuntu update for LibVNCServer
• SUSE Linux update for LibVNCServer
• SUSE Linux update for LibVNCServer
• OpenSUSE Linux update for LibVNCServer
• Heap-based buffer overflow in libvncserver (Alpine package)
• Fedora 26 update for libvncserver
• Fedora 25 update for libvncserver
• Fedora 24 update for libvncserver