Full Report
UltraVNC before 1.2.2.4 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution.
Analysis Summary
# Vulnerability: UltraVNC Heap Buffer Overflow in File Transfer Handler
## CVE Details
- CVE ID: CVE-2019-8273
- CVSS Score: 8.5 (High) - *Note: The provided CVSS string calculates to 8.5 using metrics AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which is a common interpretation for RCE.*
- CWE: Heap Buffer Overflow (Inferred from description)
## Affected Systems
- Products: UltraVNC Server
- Versions: Versions prior to 1.2.2.4
- Configurations: Requires a VNC connection established with the vulnerable server. Successful exploitation requires the user to connect to the attacker's server.
## Vulnerability Description
A heap-based buffer overflow vulnerability exists within the VNC server code of UltraVNC. This flaw is triggered during the file transfer request handler. An attacker can leverage this to write data beyond the allocated heap buffer, potentially leading to arbitrary code execution on the host running the VNC server.
## Exploitation
- Status: PoC available (Implied by context: "Existence of exploit PoC")
- Complexity: Low (Based on AV:N/AC:L metrics)
- Attack Vector: Network (AV:N)
## Impact
- Confidentiality: High (C:H in the provided CVSS string)
- Integrity: High (I:H in the provided CVSS string)
- Availability: High (A:H in the provided CVSS string)
## Remediation
### Patches
- Update UltraVNC to version **1.2.2.4 or newer**. (Vendor patch released February 2019)
### Workarounds
- Disabling or highly restricting VNC file transfer functionality if immediate patching is not possible.
- Restricting network access to the VNC server port (typically 5900/TCP) to trusted hosts only.
## Detection
- **Indicators of compromise:** Unusually high network traffic or unexpected process execution originating from the UltraVNC service after a file transfer request.
- **Detection methods and tools:** Network monitoring for anomalous file transfer commands or post-exploitation activity associated with the VNC service account.
## References
- Kaspersky ICS CERT Advisory: KLCERT-19-020
- NVD Link: [https://nvd.nist.gov/vuln/detail/CVE-2019-8273](https://nvd.nist.gov/vuln/detail/CVE-2019-8273)