Full Report
LibVNCServer before a 0.9.12 release contains a null pointer dereference in VNC client code, which can result in denial-of-service condition.
Analysis Summary
# Vulnerability: LibVNCServer NULL Pointer Dereference
## CVE Details
- **CVE ID:** CVE-2018-20024
- **CVSS Score:** 7.5 (High) - *Note: Based on vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. CVSS v3.1 calculation for Availability impact is typically High.*
- **CWE:** CWE-476 (NULL Pointer Dereference)
## Affected Systems
- **Products:** LibVNCServer / LibVNC (VNC Client code)
- **Versions:** All versions prior to release 0.9.12
- **Configurations:** Systems utilizing LibVNC client-side code to connect to VNC servers.
## Vulnerability Description
LibVNCServer contains a flaw within its client-side implementation where the software fails to properly validate pointers before dereferencing them. Specifically, a crafted response or an unexpected state during the VNC handshake/session can lead to a NULL pointer dereference. Because the application attempts to read from a memory address that is expected to be valid but is actually NULL, the process crashes.
## Exploitation
- **Status:** PoC available
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **User Interaction:** Required (An attacker must entice a user/client to connect to a malicious VNC server).
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (The vulnerability results in a Denial-of-Service [DoS] condition by crashing the client application).
## Remediation
### Patches
- **LibVNCServer 0.9.12:** Users should upgrade to version 0.9.12 or newer to resolve this flaw. The patch was officially integrated into the codebase in October 2018.
### Workarounds
- **Trusted Connections:** Only use LibVNC-based clients to connect to known and trusted VNC servers.
- **Access Control:** Implement firewall rules to restrict outbound VNC traffic (typically TCP ports 5900-5906) to authorized destinations only.
## Detection
- **Indicators of Compromise:** Unusual client application crashes specifically occurring during the initial connection phase to a VNC server.
- **Detection Methods:**
- **Static Analysis:** Scan local binaries for the LibVNC library version.
- **Traffic Monitoring:** Monitor for VNC traffic directed toward untrusted or external IP addresses.
## References
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2018/12/19/klcert-18-034-libvnc-null-pointer-dereference/
- **NVD CVE-2018-20024:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2018-20024
- **LibVNC GitHub Repository:** hxxps[://]github[.]com/LibVNC/libvncserver/