The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vino: Out of bounds read flaw by processing certain client tight encoding framebuffer update requests     (CVE-2011-0905)

  - The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before     2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used,     allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position     or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access,     related to the rfbTranslateNone and rfbSendRectEncodingRaw functions. (CVE-2011-0904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vino: Out of bounds read flaw by processing certain client tight encoding framebuffer update requests     (CVE-2011-0905)

  - The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before     2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used,     allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position     or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access,     related to the rfbTranslateNone and rfbSendRectEncodingRaw functions. (CVE-2011-0904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201412-09 (Multiple packages, Multiple vulnerabilities fixed in 2011)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      FMOD Studio       PEAR Mail       LVM2       GnuCash       xine-lib       Last.fm Scrobbler       WebKitGTK+       shadow tool suite       PEAR       unixODBC       Resource Agents       mrouted       rsync       XML Security Library       xrdb       Vino       OProfile       syslog-ng       sFlow Toolkit       GNOME Display Manager       libsoup       CA Certificates       Gitolite       QtCreator       Racer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

Two out of bounds memory access vulnerabilities in vinos' libvncserver have been fixed. CVE-2011-0904 and CVE-2011-0905 have been assigned.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2013-0169 advisory.

    - Add reachability.patch       Remove UI about whether the is only reachable locally or not.
      Fix for CVE-2011-1164
      - Bug #553477
    - Add upnp.patch       Fix for CVE-2011-1165
      - Bug #678846
    - Add clipboard-leak.patch       Fix for CVE-2012-4429
      - Bug #857250
    - Add vino-2.8.1-sanity-check-fb-update.patch       Fix for CVE-2011-0904 and CVE-2011-0904
      - Bugs #694456, #694455

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated vino package that fixes several security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Vino is a Virtual Network Computing (VNC) server for GNOME. It allows remote users to connect to a running GNOME session using VNC.

It was found that Vino transmitted all clipboard activity on the system running Vino to all clients connected to port 5900, even those who had not authenticated. A remote attacker who is able to access port 5900 on a system running Vino could use this flaw to read clipboard data without authenticating. (CVE-2012-4429)

Two out-of-bounds memory read flaws were found in the way Vino processed client framebuffer requests in certain encodings. An authenticated client could use these flaws to send a specially crafted request to Vino, causing it to crash. (CVE-2011-0904, CVE-2011-0905)

In certain circumstances, the vino-preferences dialog box incorrectly indicated that Vino was only accessible from the local network. This could confuse a user into believing connections from external networks are not allowed (even when they are allowed). With this update, vino-preferences no longer displays connectivity and reachable information. (CVE-2011-1164)

There was no warning that Universal Plug and Play (UPnP) was used to open ports on a user's network router when the 'Configure network automatically to accept connections' option was enabled (it is disabled by default) in the Vino preferences. This update changes the option's description to avoid the risk of a UPnP router configuration change without the user's consent. (CVE-2011-1165)

All Vino users should upgrade to this updated package, which contains backported patches to resolve these issues. The GNOME session must be restarted (log out, then log back in) for this update to take effect.

It was found that Vino transmitted all clipboard activity on the system running Vino to all clients connected to port 5900, even those who had not authenticated. A remote attacker who is able to access port 5900 on a system running Vino could use this flaw to read clipboard data without authenticating. (CVE-2012-4429)

Two out-of-bounds memory read flaws were found in the way Vino processed client framebuffer requests in certain encodings. An authenticated client could use these flaws to send a specially crafted request to Vino, causing it to crash. (CVE-2011-0904, CVE-2011-0905)

In certain circumstances, the vino-preferences dialog box incorrectly indicated that Vino was only accessible from the local network. This could confuse a user into believing connections from external networks are not allowed (even when they are allowed). With this update, vino-preferences no longer displays connectivity and reachable information. (CVE-2011-1164)

There was no warning that Universal Plug and Play (UPnP) was used to open ports on a user's network router when the 'Configure network automatically to accept connections' option was enabled (it is disabled by default) in the Vino preferences. This update changes the option's description to avoid the risk of a UPnP router configuration change without the user's consent. (CVE-2011-1165)

The GNOME session must be restarted (log out, then log back in) for this update to take effect.

This security update fixes two out-of-bounds memory access vulnerabilities in vinos' libvncserver. (CVE-2011-0904 / CVE-2011-0905 )

Additionally, another possible server crash has been fixed.
(bln440712)

Kevin Chen discovered that Vino incorrectly handled certain client framebuffer requests. A remote attacker could use this flaw to cause Vino to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update fixes two out-of-bounds memory access vulnerabilities in vinos' libvncserver. (CVE-2011-0904 / CVE-2011-0905)

Additionally, another possible server crash has been fixed.
(bln440712)

Kevin Chen discovered that incorrect processing of framebuffer requests in the Vino VNC server could lead to denial of service.

- Sun May 8 2011 Christopher Aillon <caillon at     redhat.com> - 2.28.3-1

    - Update to 2.28.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Sun May 8 2011 Christopher Aillon <caillon at     redhat.com> - 2.32.2-1

    - Update to 2.32.2

    - Wed Sep 29 2010 Matthias Clasen <mclasen at       redhat.com> - 2.32.0-1

    - Update to 2.32.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in vino :

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions (CVE-2011-0904).

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation (CVE-2011-0905).

The updated packages have been upgraded to 2.28.3 which is not vulnerable to these isssues.

ID	Name	Product	Family	Severity
199447	RHEL 5 : vino (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199420	RHEL 4 : vino (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
79962	GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011	Nessus	Gentoo Local Security Checks	critical
76041	openSUSE Security Update : vino (openSUSE-SU-2011:0481-1)	Nessus	SuSE Local Security Checks	low
75768	openSUSE Security Update : vino (openSUSE-SU-2011:0481-1)	Nessus	SuSE Local Security Checks	low
68712	Oracle Linux 6 : vino (ELSA-2013-0169)	Nessus	Oracle Linux Local Security Checks	medium
63671	CentOS 6 : vino (CESA-2013:0169)	Nessus	CentOS Local Security Checks	medium
63664	Scientific Linux Security Update : vino on SL6.x i386/x86_64 (20130121)	Nessus	Scientific Linux Local Security Checks	medium
63641	RHEL 6 : vino (RHSA-2013:0169)	Nessus	Red Hat Local Security Checks	medium
57258	SuSE 10 Security Update : vino (ZYPP Patch Number 7531)	Nessus	SuSE Local Security Checks	low
55089	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : vino vulnerabilities (USN-1128-1)	Nessus	Ubuntu Local Security Checks	low
55021	SuSE 10 Security Update : vino (ZYPP Patch Number 7532)	Nessus	SuSE Local Security Checks	low
55020	SuSE 11.1 Security Update : vino (SAT Patch Number 4575)	Nessus	SuSE Local Security Checks	low
54588	Debian DSA-2238-1 : vino - several vulnerabilities	Nessus	Debian Local Security Checks	low
54295	Fedora 13 : vino-2.28.3-1.fc13 (2011-6778)	Nessus	Fedora Local Security Checks	low
54293	Fedora 14 : vino-2.32.2-1.fc14 (2011-6773)	Nessus	Fedora Local Security Checks	low
54288	Mandriva Linux Security Advisory : vino (MDVSA-2011:087)	Nessus	Mandriva Local Security Checks	low
53889	openSUSE Security Update : vino (openSUSE-SU-2011:0481-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2011-0905

medium

Tenable Plugins

medium

medium

critical

low

low

medium

medium

medium

medium

low

low

low

low

low

low

low

low

low