Integer Overflow Leading to Heap Buffer Overflow in UltraVNC Repeater

Executive Summary

This vulnerability is an integer overflow in the UltraVNC repeater version through 1.8.2.2, specifically in the HTTP request logging path. The issue occurs in the win_log() function, which allocates memory for list nodes based on the length of HTTP request URIs. If the URI length is very large, the calculation for the memory allocation overflows, resulting in a smaller-than-needed allocation. When the full URI string is copied into this undersized buffer, it causes a heap buffer overflow.

This overflow is limited by the maximum HTTP receive buffer size, which restricts the overflow to a partial heap write. An attacker can trigger this by sending a maximally-sized URI in an HTTP request to the repeater's HTTP port without needing to authenticate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an integer overflow triggered by sending a maximally-sized URI in an HTTP request to the UltraVNC repeater HTTP port. Detection can focus on monitoring HTTP requests to the repeater for unusually large URI sizes.

You can detect potential exploitation attempts by capturing and analyzing network traffic targeting the UltraVNC repeater HTTP port, looking for HTTP requests with very long URIs.

• Use tcpdump or Wireshark to capture traffic on the UltraVNC repeater HTTP port (default port may vary, commonly 5800 or 5801):
• tcpdump -i <interface> 'tcp port <UltraVNC_HTTP_port>' -w capture.pcap
• Analyze captured traffic for HTTP requests with unusually long URIs, for example using tshark:
• tshark -r capture.pcap -Y 'http.request.uri and frame.len > 1000' -T fields -e http.request.uri

Alternatively, you can use intrusion detection systems (IDS) or web application firewalls (WAF) to alert on HTTP requests with URI lengths approaching the buffer size limit (around 150 KB).

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a remote unauthenticated attacker to cause a heap buffer overflow by sending a specially crafted HTTP request with a very large URI. This can lead to partial heap memory corruption.

While the overflow is bounded and limited to a partial heap write due to buffer size restrictions, it could potentially be exploited to disrupt the normal operation of the UltraVNC repeater, causing denial of service or possibly enabling further attacks depending on the context.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the UltraVNC repeater HTTP port to trusted networks or hosts only, to prevent remote unauthenticated attackers from sending malicious HTTP requests.

Additionally, monitor and block HTTP requests with abnormally large URIs targeting the repeater port.

Applying any available patches or updates from the UltraVNC project that address this integer overflow vulnerability is strongly recommended once they are released.

If patching is not immediately possible, consider disabling the HTTP repeater functionality or replacing the repeater with a more secure alternative until a fix is applied.

Useful 0 Not Useful 0