Full Report
UltraVNC Viewer before 1.2.2.4 has a out-of-bounds read vulnerability in RRE decoder code, caused by multiplication overflow.
Analysis Summary
# Vulnerability: UltraVNC Viewer RRE Decoder Out-of-Bounds Read
## CVE Details
- **CVE ID:** CVE-2019-8260
- **CVSS Score:** 7.5 (High) *Note: While the source text lists a calculation resulting in 0.0, the provided vector string and NVD standard for this CVE denote High severity.*
- **CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- **CWE:** CWE-125 (Out-of-bounds Read), CWE-190 (Integer Overflow)
## Affected Systems
- **Products:** UltraVNC Viewer
- **Versions:** All versions prior to 1.2.2.4
- **Configurations:** Systems utilizing the RRE (Rise-and-Run-length Encoding) decoder during a VNC session.
## Vulnerability Description
A vulnerability exists in the RRE decoder of UltraVNC Viewer due to insufficient validation of input data. Specifically, a multiplication overflow occurs during the processing of pixel data. When the viewer decodes RRE-encoded rectangles sent from a VNC server, an attacker-controlled size value can trigger an integer overflow, leading to an out-of-bounds read. This allows the application to access memory locations outside of the intended buffer.
## Exploitation
- **Status:** PoC available
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **Requirements:** Successful exploitation requires a user to connect their UltraVNC Viewer to a malicious or compromised VNC server controlled by the attacker.
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Information leads to application crash / Denial-of-Service)
## Remediation
### Patches
- **UltraVNC 1.2.2.4:** Technical patches were released in February 2019. Users should upgrade to version 1.2.2.4 or the latest stable production version.
### Workarounds
- **Trusted Connections:** Only connect to known, trusted VNC servers.
- **Protocol Filtering:** Restrict VNC traffic (typically port 5900) to authorized internal IP addresses only via firewalls.
## Detection
- **Indicators of compromise:** Frequent, unexplained crashes of the `vncviewer.exe` process when connecting to remote hosts.
- **Detection methods and tools:** Use Vulnerability Scanners to identify outdated versions of UltraVNC installed on workstations. Monitor for unusual network traffic patterns on VNC-related ports.
## References
- **Vendor Advisory:** hxxps[://]www[.]uvnc[.]com/
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2019/03/01/klcert-19-006-ultravnc-out-of-bound-read/
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2019-8260