An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4573-1 advisory.

  - The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier     does not properly handle attempts to send a large amount of ClientCutText data, which allows remote     attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is     processed by using a single unchecked malloc. (CVE-2014-6053)

  - An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c     does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or     possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
    (CVE-2018-7225)

  - LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC     server code, which allow an attacker to read stack memory and can be abused for information disclosure.
    Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack     appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access     via encodings. (CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access     via encodings. (CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via     encodings. (CVE-2020-14404)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNCServer makes writing a VNC server (or more     correctly, a program exporting a frame-buffer via the     Remote Frame Buffer protocol) easy. It hides the     programmer from the tedious task of managing clients     and compression schemata.Security Fix(es):An issue was     discovered in LibVNCServer before 0.9.13. There is an     information leak (of uninitialized memory contents) in     the libvncclient/rfbproto.c ConnectToRFBRepeater     function.(CVE-2018-21247)libvncclient/sockets.c in     LibVNCServer before 0.9.13 has a buffer overflow via a     long socket filename.(CVE-2019-20839)An issue was     discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)An issue was discovered in     LibVNCServer before 0.9.13. An improperly closed TCP     connection causes an infinite loop in     libvncclient/sockets.c.(CVE-2020-14398)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint32_t pointers in     libvncclient/rfbproto.c. NOTE: there is reportedly 'no     trust boundary crossed.'(CVE-2020-14399)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint16_t pointers in     libvncserver/translate.c. NOTE: Third parties do not     consider this to be a vulnerability as there is no     known path of exploitation or cross of a trust     boundary.(CVE-2020-14400)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/scale.c has a     pixel_value integer overflow.(CVE-2020-14401)An issue     was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/hextile.c     allows out-of-bounds access via     encodings.(CVE-2020-14403)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/rre.c allows     out-of-bounds access via encodings.(CVE-2020-14404)An     issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)libvncclient/cursor.c in     LibVNCServer through 0.9.12 has a HandleCursorShape     integer overflow and heap-based buffer overflow via a     large height or width value. (CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserve packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several minor vulnerabilities have been discovered in libvncserver, a server and client implementation of the VNC protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c has a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

NOTE: This issue has been disputed by third parties; there is reportedly 'no trust boundary crossed'.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

NOTE: This issue has been disputed by third parties. There is no known path of exploitation or cross of a trust boundary.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c did not limit TextChat size.

For Debian 9 stretch, these problems have been fixed in version 0.9.11+dfsg-1.3~deb9u5.

We recommend that you upgrade your libvncserver packages.

For the detailed security status of libvncserver please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libvncserver

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

security update fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitrary code. (CVE-2019-20839) It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840) Christian Beier discovered that LibVNCServer incorrectly handled anonymous TLS connections. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14396) It was discovered that LibVNCServer incorrectly handled region clipping. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14397) It was discovered that LibVNCServer did not properly reset incorrectly terminated TCP connections. A remote attacker could possibly use this issue to cause an infinite loop, resulting in a denial of service. (CVE-2020-14398) It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service.
(CVE-2020-14399, CVE-2020-14400) It was discovered that LibVNCServer incorrectly handled screen scaling on the server side. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2020-14401) It was discovered that LibVNCServer incorrectly handled encodings. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404) It was discovered that LibVNCServer incorrectly handled TextChat messages. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14405).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in libVNC (libvncserver Debian package), an implemenantation of the VNC server and client protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c had a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c does not limit TextChat size.

For Debian 8 'Jessie', these problems have been fixed in version 0.9.9+dfsg2-6.1+deb8u8.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
142357	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2020-2362)	Nessus	Huawei Local Security Checks	high
141301	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Vino vulnerabilities (USN-4573-1)	Nessus	Ubuntu Local Security Checks	critical
140883	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2020-2116)	Nessus	Huawei Local Security Checks	critical
140161	EulerOS 2.0 SP5 : libvncserve (EulerOS-SA-2020-1940)	Nessus	Huawei Local Security Checks	high
140046	Debian DLA-2347-1 : libvncserver security update	Nessus	Debian Local Security Checks	medium
139453	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:2167-1)	Nessus	SuSE Local Security Checks	critical
139141	EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2020-1811)	Nessus	Huawei Local Security Checks	high
138999	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer vulnerabilities (USN-4434-1)	Nessus	Ubuntu Local Security Checks	medium
137907	Debian DLA-2264-1 : libvncserver security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-14404

medium

Tenable Plugins

high

critical

critical

high

medium

critical

high

medium

medium