Heap-based buffer overflow in LibVNCServer - CVE-2016-9942

Vulnerability identifier: #VU3077

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9942

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on vulnerable client system.

A heap-based buffer overflow vulnerability exists due to boundary error in ultra.c in LibVNCClient software, which is bundled with LibVNCServer. A remote attacker can trick the victim to connect to malicious VNC server, send a specially  crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions, and trigger buffer overflow.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable VNC client.

LibVNCServer
Arch Linux
Gentoo Linux
SUSE Linux
Ubuntu
Fedora
libvncserver (Alpine package)
libvncserver

Update to version 0.9.11:
https://github.com/LibVNC/libvncserver/tree/LibVNCServer-0.9.11

libvncserver (Alpine package) - update to 0.9.10-r2
libvncserver - addressed in versions 0.9.11-2.fc24.1, 0.9.11-2.fc25.1, 0.9.11-2.fc26

• https://github.com/LibVNC/libvncserver/pull/137
• https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11

• Two heap-based buffer overflows in LibVNCClient
• Gentoo update for LibVNCServer/LibVNCClient
• Arch Linux update for libvncserver
• Ubuntu update for LibVNCServer
• SUSE Linux update for LibVNCServer
• SUSE Linux update for LibVNCServer
• OpenSUSE Linux update for LibVNCServer
• Heap-based buffer overflow in libvncserver (Alpine package)
• Fedora 26 update for libvncserver
• Fedora 25 update for libvncserver
• Fedora 24 update for libvncserver