UltraVNC vncviewer Stack Overflow Lets Remote Users Execute Arbitrary Code

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1019293

SecurityTracker URL: http://securitytracker.com/id/1019293

CVE Reference: CVE-2008-0610 (Links to External Site)

Updated: Feb 7 2008

Original Entry Date: Feb 1 2008

Impact: Execution of arbitrary code via network, User access via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 1.0.2 and 1.0.4 latest RC

Description: A vulnerability was reported in the UltraVNC vncviewer. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to the target vncviewer client (when in LISTENING mode) to trigger a stack overflow and execute arbitrary code on the target system.

The UltraVNC server is not affected.

Impact: A remote user can execute arbitrary code on the target system.

Solution: The vendor has issued a security update for the version 1.0.2 and 1.0.4 viewer, available at:

http://downloads.sourceforge.net/ultravnc/UltraVNC-Viewer-104-Security-Update.zip

The UltraVNC advisory is available at:

http://forum.ultravnc.info/viewtopic.php?t=11850

Vendor URL: forum.ultravnc.info/viewtopic.php?t=11850 (Links to External Site)

Cause: Boundary error

Underlying OS: Windows (Any)

Message History: None.

Date: Fri, 1 Feb 2008 08:57:20 -0500
Subject: UltraVNC


http://forum.ultravnc.info/viewtopic.php?t=11850