libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14355-1 advisory.

  - LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC     server code, which allow an attacker to read stack memory and can be abused for information disclosure.
    Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack     appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0920 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in     HandleCursorShape function (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0920 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for LibVNCServer fixes the following issues :

CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).

CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).

CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4407-1 advisory.

    It was discovered that LibVNCServer incorrectly handled decompressing data. An attacker could possibly use     this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680)

    It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a     ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This     issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)

    It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to     connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15690, CVE-2019-20788)

    It was discovered that LibVNCServer incorrectly handled decoding WebSocket frames. An attacker could     possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.
    (CVE-2017-18922)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for LibVNCServer fixes the following issues :

  - CVE-2019-15690: Fixed a heap buffer overflow     (bsc#1160471).

  - CVE-2019-15681: Fixed a memory leak which could have     allowed to a remote attacker to read stack memory     (bsc#1155419).

  - CVE-2019-20788: Fixed a integer overflow and heap-based     buffer overflow via a large height or width value     (bsc#1170441).

This update was imported from the SUSE:SLE-15:Update update project.

Integer Overflow or Wraparound leads to Heap-based Buffer Overflow (CVE-2019-15690)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0913 advisory.

    [0.9.9-14]
    - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client)       (bug #1814339)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0913 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0920 advisory.

    [0.9.11-9.2]
    - Enable gating (bug #1681199)

    [0.9.11-9.1]
    - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client)       (bug #1814342)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0913 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libvncserver: HandleCursorShape() integer overflow     resulting in heap-based buffer overflow (CVE-2019-15690)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0921 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In libvncserver, through libvncclient/cursor.c, there is a possibility of a heap overflow, as reported by Pavel Cheremushkin.

For Debian 8 'Jessie', this problem has been fixed in version 0.9.9+dfsg2-6.1+deb8u7.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196364	RHEL 6 : libvncserver (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
150539	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2020:14355-1)	Nessus	SuSE Local Security Checks	critical
145958	CentOS 8 : libvncserver (CESA-2020:0920)	Nessus	CentOS Local Security Checks	critical
143980	NewStart CGSL CORE 5.05 / MAIN 5.05 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0087)	Nessus	NewStart CGSL Local Security Checks	critical
143006	RHEL 8 : libvncserver (RHSA-2020:0920)	Nessus	Red Hat Local Security Checks	critical
140281	NewStart CGSL CORE 5.04 / MAIN 5.04 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0038)	Nessus	NewStart CGSL Local Security Checks	critical
138259	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-2)	Nessus	SuSE Local Security Checks	critical
138132	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer vulnerabilities (USN-4407-1)	Nessus	Ubuntu Local Security Checks	critical
136453	openSUSE Security Update : LibVNCServer (openSUSE-2020-624)	Nessus	SuSE Local Security Checks	critical
136396	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:1165-1)	Nessus	SuSE Local Security Checks	critical
136395	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-1)	Nessus	SuSE Local Security Checks	critical
135929	Amazon Linux 2 : libvncserver (ALAS-2020-1411)	Nessus	Amazon Linux Local Security Checks	high
134931	Oracle Linux 7 : libvncserver (ELSA-2020-0913)	Nessus	Oracle Linux Local Security Checks	critical
134913	CentOS 7 : libvncserver (RHSA-2020:0913)	Nessus	CentOS Local Security Checks	critical
134887	Oracle Linux 8 : libvncserver (ELSA-2020-0920)	Nessus	Oracle Linux Local Security Checks	critical
134861	RHEL 7 : libvncserver (RHSA-2020:0913)	Nessus	Red Hat Local Security Checks	critical
134847	Scientific Linux Security Update : libvncserver on SL7.x x86_64 (20200323)	Nessus	Scientific Linux Local Security Checks	high
134837	RHEL 8 : libvncserver (RHSA-2020:0921)	Nessus	Red Hat Local Security Checks	critical
134633	Debian DLA-2146-1 : libvncserver security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-15690

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical

high