TigerVNC ZRLE decoding bounds checking issue

2014.03.19
Credit: Tomas Hoger
Risk: High
Local: Yes
Remote: No
CWE: CWE-787


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

TigerVNC 1.3.1 fixes ZRLE decoding bounds checking issue New release of TigerVNC fixes an issue with boundary checks in the ZRLE decoding. Boundary checks existed in the code in form of assert()s, which were removed in builds with NDEBUG defined. That is default for release builds done by cmake, which is used by TigerVNC. This could possibly allow malicious server to compromise vncviewer. The same problem may affect related *VNC implementations if built with NDEBUG. CVE-2014-0011 was assigned to the issue. References: http://sourceforge.net/p/tigervnc/mailman/message/32120476/ http://sourceforge.net/p/tigervnc/code/5163 http://sourceforge.net/p/tigervnc/code/5164 https://bugzilla.redhat.com/show_bug.cgi?id=1050928

References:

http://sourceforge.net/p/tigervnc/mailman/message/32120476/
http://sourceforge.net/p/tigervnc/code/5163
http://sourceforge.net/p/tigervnc/code/5164
https://bugzilla.redhat.com/show_bug.cgi?id=1050928


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top