Title: AT&T WinVNC Client Buffer Overflow Vulnerability
Severity: MODERATE
Description:
VNC is the Virtual Network Computing package, a freely available remote administration package designed to allow access to a remote system desktop. It is distributed and maintained by AT&T.
A problem with the client portion of the package could allow a remote user to execute arbitrary code. This is due to the handling of the 'rfbConnFailed' packet sent from the server to the client during connection and authentication. This error response normally signals the client that the connection attempt has failed, at which time the client passes the contents of the packet through a logging routine for future administrative reference. However, by spoofing the version number of the server and then sending the 'rfbConnFailed' packet with a reason string of 1024 bytes and a reason length of greater than 1024 bytes, an attacker can cause an overflow to occur. This overflow could be used to overwrite stack variables, including the return address, and to execute arbitrary code.
This issue allows an attacker to execute code on a remote system, with the privileges of the user of the WinVNC client.
Affected Products:
- AT&T WinVNC 3.3.3 r9
- AT&T WinVNC Client 3.3.3 r7
References:
- CORE Security: WinVNC Client exploit
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
