Heap-based Buffer Overflow in TightVNC and UltraVNC Viewers

Executive Summary

This is a heap-based buffer overflow in TightVNC and UltraVNC viewers during JPEG decoding. The vulnerability occurs when a malicious VNC server sends a JPEG framebuffer rectangle with an attacker-controlled width that exceeds the fixed-size decoding buffer. The DecompressJpegRect() function allocates a buffer based on a hardcoded maximum row width but fails to validate the server-supplied rectangle width, leading to out-of-bounds memory writes. This can crash the viewer application and potentially allow arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of your TightVNC or UltraVNC viewer. UltraVNC versions prior to 1.8.2.8 are vulnerable. For TightVNC, no fixed version is available, so any version may be affected. Commands to check versions include 'vncviewer -version' for UltraVNC or checking installed program details in Windows.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable TightVNC or UltraVNC viewer and connect to a malicious or compromised VNC server, this vulnerability could crash your viewer application. In worst cases, it may allow the attacker to execute arbitrary code on your system, potentially leading to full system compromise. Exploitation requires you to connect to an attacker-controlled server, so avoiding untrusted servers reduces risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data security and integrity during remote desktop sessions. A heap-based buffer overflow could allow unauthorized code execution or denial of service, potentially leading to unauthorized access to sensitive data transmitted or displayed during VNC sessions. This may violate GDPR's data protection requirements for secure processing and HIPAA's safeguards for protected health information if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade UltraVNC to version 1.8.3.1 or later. For TightVNC, replace the viewer with a maintained version or restrict connections to trusted VNC servers until a patched version is available. Avoid connecting to untrusted VNC servers.

Useful 0 Not Useful 0