Full Report
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client code, which can potentially result code execution. This attack appear to be exploitable via network connectivity. User interaction is required to trigger these vulnerabilities. These vulnerabilities have been fixed in revision 1208.
Analysis Summary
# Vulnerability: UltraVNC Client OOB Access in Copybuffer
## CVE Details
- **CVE ID:** CVE-2019-8266
- **CVSS Score:** 8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- **CWE:** CWE-788 (Access of Memory Location After End of Buffer)
## Affected Systems
- **Products:** UltraVNC (VNC Client)
- **Versions:** All versions prior to 1.2.2.4 (specifically cited in revision 1207 and earlier)
- **Configurations:** Systems running the UltraVNC client that connect to remote VNC servers over a network.
## Vulnerability Description
The vulnerability exists due to the improper usage of the `ClientConnection::Copybuffer` function within the UltraVNC client code. Specifically, the software performs an out-of-bounds access by referencing a memory location after the end of the intended buffer.
Technical analysis indicates that an attacker-controlled VNC server can send malformed data packets to a connecting client. Because the client does not properly validate the bounds of the buffer during the copy operation, this results in memory corruption.
## Exploitation
- **Status:** Proof of Concept (PoC) available.
- **Complexity:** Low.
- **Attack Vector:** Network. The vulnerability is triggered when a user connects their client to a malicious or compromised VNC server.
## Impact
- **Confidentiality:** High (Potential to leak sensitive information from memory).
- **Integrity:** High (Potential for arbitrary code execution and system data modification).
- **Availability:** High (Can result in a Denial-of-Service condition/application crash).
## Remediation
### Patches
- **UltraVNC 1.2.2.4:** This version (revision 1208) contains the fix for the reported memory access issues. Users should update immediately.
### Workarounds
- **Restrict Connections:** Avoid connecting the UltraVNC client to untrusted or unknown VNC servers.
- **Network Filtering:** Use firewalls or VPNs to ensure client-server communication only occurs between trusted endpoints.
## Detection
- **Indicators of Compromise:** Unusual application crashes (Segmentation Faults) of the `vncviewer.exe` process when connecting to remote hosts.
- **Detection Methods and Tools:**
- Monitor network traffic for non-standard or malformed VNC RFB (Remote Framebuffer) protocol initialization packets.
- Use Vulnerability Scanners to identify outdated versions of UltraVNC (pre-1.2.2.4) installed on workstations.
## References
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2019/03/01/klcert-19-013-ultravnc-access-of-memory-location-after-end-of-buffer/
- **NVD CVE-2019-8266:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2019-8266
- **CWE-788 Detail:** hxxps[://]cwe[.]mitre[.]org/data/definitions/788[.]html