Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.

A format string problem in vinagre potentially allowed malicious VNC servers to have a vinagre client that connects to the server execute arbitrary code. (CVE-2008-5660)

Alfredo Ortega found a flaw in how Vinagre uses format strings. A remote attacker could exploit this vulnerability if they were able to trick a user into connecting to a malicious VNC server, or opening a specially crafted URI with Vinagre. With older versions of Vinagre, it was possible to execute arbitrary code with user privileges. In later versions, Vinagre would abort, leading to a denial of service.

The updated packages have been patched to prevent this issue.

Alfredo Ortega discovered a flaw in Vinagre's use of format strings. A remote attacker could exploit this vulnerability if they tricked a user into connecting to a malicious VNC server, or opening a specially crafted URI with Vinagre. In Ubuntu 8.04, it was possible to execute arbitrary code with user privileges. In Ubuntu 8.10, Vinagre would simply abort, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-01 (Vinagre: User-assisted execution of arbitrary code)

    Alfredo Ortega (Core Security Technologies) reported a format string     error in the vinagre_utils_show_error() function in     src/vinagre-utils.c.
  Impact :

    A remote attacker could entice a user into opening a specially crafted     .vnc file or connecting to a malicious server, possibly resulting in     the remote execution of arbitrary code with the privileges of the user     running the application.
  Workaround :

    There is no known workaround at this time.

CORE Security Technologies reports :

A format string error has been found on the vinagre_utils_show_error() function that can be exploited via commands issued from a malicious server containing format string specifiers on the VNC name.

In a web-based attack scenario, the user would be required to connect to a malicious server. Successful exploitation would then allow the attacker to execute arbitrary code with the privileges of the Vinagre user.

Update backports fix for a format string flaw in vinagre_utils_show_error() from new upstream 0.5.2 / 2.24.2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release 0.5.2 fixing format string flaw in vinagre_utils_show_error().

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40318	openSUSE Security Update : vinagre (vinagre-402)	Nessus	SuSE Local Security Checks	medium
40148	openSUSE Security Update : vinagre (vinagre-402)	Nessus	SuSE Local Security Checks	medium
38069	Mandriva Linux Security Advisory : vinagre (MDVSA-2008:240)	Nessus	Mandriva Local Security Checks	medium
36896	Ubuntu 8.04 LTS / 8.10 : vinagre vulnerability (USN-689-1)	Nessus	Ubuntu Local Security Checks	medium
35791	GLSA-200903-01 : Vinagre: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
35284	FreeBSD : vinagre -- format string vulnerability (214e8e07-d369-11dd-b800-001b77d09812)	Nessus	FreeBSD Local Security Checks	medium
35064	Fedora 8 : vinagre-0.4-2.fc8 (2008-10941)	Nessus	Fedora Local Security Checks	medium
35062	Fedora 9 : vinagre-0.5.2-1.fc9 (2008-10932)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5660

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium