TightVNC Viewer < 1.3.10 Multiple Integer Overflows

high Nessus Plugin ID 35702

Synopsis

The remote Windows host has an application that is affected by multiple integer overflows.

Description

The installed version of TightVNC Viewer is earlier than 1.3.10. Such versions reportedly miscalculate a buffer size on the heap. If an attacker can trick a user on the remote host into connecting to a malicious server, he can probably exploit this issue using specially crafted messages to execute code on the affected host subject to the user's privileges.

Solution

Upgrade to TightVNC 1.3.10 or later.

Plugin Details

Severity: High

ID: 35702

File Name: tightvnc_1_3_10.nasl

Version: 1.10

Type: local

Agent: windows

Family: Windows

Published: 2/18/2009

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.1

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Exploitable With

Core Impact

Reference Information

CVE: CVE-2009-0388

BID: 33568

CWE: 189

Detections

Analytics