Month: December 2021

UltraVNC Viewer VNC client RFB SolidColor Arbitrary Write Vulnerability

by

EIP-0e1ca3ec

A vulnerability exists within UltraVNC’s “vncviewer.exe” client. A malicious server can trigger an arbitrary memory write condition through a flaw in the function ClientConnection::SolidColor while drawing pixel data to the screen. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the UltraVNC Viewer process.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-0e1ca3ec
  • MITRE CVE: PENDING

Vulnerability Metrics

  • CVSSv2 Score: 5.8

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: December 8th, 2021
  • Disclosed to public: December 16th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

UltraVNC Viewer VNC client RFB rfbServerInitMsg Heap Overflow Vulnerability

by

EIP-0e1ca3ec

A vulnerability exists within UltraVNC’s “vncviewer.exe” client. Specifically a malicious server may write arbitrary data to arbitrary memory locations through the  in the “rfbServerInitMsg” function upon parsing a long ‘nameLength’ field returned from a nefarious server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the UltraVNC Viewer process.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-0e1ca3ec
  • MITRE CVE: PENDING

Vulnerability Metrics

  • CVSSv2 Score: 5.8

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: December 8th, 2021
  • Disclosed to public: December 16th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

UltraVNC Viewer VNC client RFB ReadUltraRect Heap Overflow Vulnerability

by

EIP-930b0ea5

A vulnerability exists within UltraVNC’s “vncviewer.exe” client. Specifically a heap overflow can be triggered in the “ClientConnection::ReadUltraRect” function upon decompression of malicious formatted data returned from a nefarious server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the UltraVNC Viewer process.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-930b0ea5
  • MITRE CVE: PENDING

Vulnerability Metrics

  • CVSSv2 Score: 5.8

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: December 8th, 2021
  • Disclosed to public: December 16th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

UltraVNC Viewer VNC client Remote Memory Leak Vulnerability

by

EIP-5182fb5b

A vulnerability exists within UltraVNC view due to a lack of proper stack memory buffer cleanup before constructing the ‘rfbTextChat’ message, which results in a leak of 3-bytes of stack memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the UltraVNC Viewer process.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-5182fb5b
  • MITRE CVE: 

Vulnerability Metrics

  • CVSSv2 Score: 4.3

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: June 21th, 2021
  • Disclosed to public: September 25th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

Intelligence

Support

Company

Copyright 2021 Exodus Intelligence