UltraVNC Repeater HTTP Server Buffer Overflow

Executive Summary

This vulnerability exists in UltraVNC repeater versions up to 1.8.2.2 in its embedded HTTP administration server. Specifically, the functions wi_senderr() and wi_replyhdr() write the HTTP request URI into a fixed-size 1000-byte global buffer without proper bounds checking. Since the HTTP receive buffer can accept URIs up to approximately 150 KB, an attacker can send a specially crafted HTTP request with a URI longer than 1500 bytes to overflow this buffer by at least 500 bytes.

The overflow corrupts adjacent global variables in memory before any authentication check is performed, allowing a remote, unauthenticated attacker who can reach the repeater's HTTP port (default TCP 80) to execute arbitrary code on the host running the repeater.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including complete compromise of the affected system. Because it allows remote, unauthenticated attackers to execute arbitrary code, an attacker could gain full control over the host running the UltraVNC repeater.

• Unauthorized access to sensitive data or system resources.
• Potential disruption or denial of service by crashing the application or system.
• Use of the compromised system as a foothold for further attacks within the network.

Useful 0 Not Useful 0