An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvncserver: Multiple heap out-of-bound writes in VNC client code (Incomplete fix for CVE-2018-20019)     (CVE-2018-20748)

  - Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote     servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted     FramebufferUpdate message containing a subrectangle outside of the client drawing area. (CVE-2016-9941)

  - Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers     to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted     FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds     what is specified by the tile dimensions. (CVE-2016-9942)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1811 advisory.

    - Fix CVE-2020-25708       Resolves: #1898078
    - Fix CVE-2019-20839       Resolves: #1851032
    - Fix CVE-2018-21247       Resolves: #1852516
    - Fix CVE-2020-14405       Resolves: #1860527

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1811 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

    * libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

    * libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

    * libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

    * libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNCServer makes writing a VNC server (or more     correctly, a program exporting a frame-buffer via the     Remote Frame Buffer protocol) easy. It hides the     programmer from the tedious task of managing clients     and compression schemata.Security Fix(es):An issue was     discovered in LibVNCServer before 0.9.13. There is an     information leak (of uninitialized memory contents) in     the libvncclient/rfbproto.c ConnectToRFBRepeater     function.(CVE-2018-21247)libvncclient/sockets.c in     LibVNCServer before 0.9.13 has a buffer overflow via a     long socket filename.(CVE-2019-20839)An issue was     discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)An issue was discovered in     LibVNCServer before 0.9.13. An improperly closed TCP     connection causes an infinite loop in     libvncclient/sockets.c.(CVE-2020-14398)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint32_t pointers in     libvncclient/rfbproto.c. NOTE: there is reportedly 'no     trust boundary crossed.'(CVE-2020-14399)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint16_t pointers in     libvncserver/translate.c. NOTE: Third parties do not     consider this to be a vulnerability as there is no     known path of exploitation or cross of a trust     boundary.(CVE-2020-14400)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/scale.c has a     pixel_value integer overflow.(CVE-2020-14401)An issue     was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/hextile.c     allows out-of-bounds access via     encodings.(CVE-2020-14403)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/rre.c allows     out-of-bounds access via encodings.(CVE-2020-14404)An     issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)libvncclient/cursor.c in     LibVNCServer through 0.9.12 has a HandleCursorShape     integer overflow and heap-based buffer overflow via a     large height or width value. (CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserve packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several minor vulnerabilities have been discovered in libvncserver, a server and client implementation of the VNC protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c has a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

NOTE: This issue has been disputed by third parties; there is reportedly 'no trust boundary crossed'.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

NOTE: This issue has been disputed by third parties. There is no known path of exploitation or cross of a trust boundary.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c did not limit TextChat size.

For Debian 9 stretch, these problems have been fixed in version 0.9.11+dfsg-1.3~deb9u5.

We recommend that you upgrade your libvncserver packages.

For the detailed security status of libvncserver please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libvncserver

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4434-1 advisory.

    Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names.
    A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or     possibly execute arbitrary code. (CVE-2019-20839)

    It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could     possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only     affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)

    Christian Beier discovered that LibVNCServer incorrectly handled anonymous TLS connections. A remote     attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service.
    This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14396)

    It was discovered that LibVNCServer incorrectly handled region clipping. A remote attacker could possibly     use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14397)

    It was discovered that LibVNCServer did not properly reset incorrectly terminated TCP connections. A     remote attacker could possibly use this issue to cause an infinite loop, resulting in a denial of service.
    (CVE-2020-14398)

    It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could     possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399,     CVE-2020-14400)

    It was discovered that LibVNCServer incorrectly handled screen scaling on the server side. A remote     attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2020-14401)

    It was discovered that LibVNCServer incorrectly handled encodings. A remote attacker could use this issue     to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)

    It was discovered that LibVNCServer incorrectly handled TextChat messages. A remote attacker could     possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14405)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in libVNC (libvncserver Debian package), an implemenantation of the VNC server and client protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c had a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c does not limit TextChat size.

For Debian 8 'Jessie', these problems have been fixed in version 0.9.9+dfsg2-6.1+deb8u8.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199929	RHEL 7 : libvncserver (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196364	RHEL 6 : libvncserver (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184742	Rocky Linux 8 : libvncserver (RLSA-2021:1811)	Nessus	Rocky Linux Local Security Checks	high
160737	NewStart CGSL MAIN 6.02 : libvncserver Multiple Vulnerabilities (NS-SA-2022-0048)	Nessus	NewStart CGSL Local Security Checks	high
157648	AlmaLinux 8 : libvncserver (ALSA-2021:1811)	Nessus	Alma Linux Local Security Checks	high
149968	Oracle Linux 8 : libvncserver (ELSA-2021-1811)	Nessus	Oracle Linux Local Security Checks	high
149728	CentOS 8 : libvncserver (CESA-2021:1811)	Nessus	CentOS Local Security Checks	high
149663	RHEL 8 : libvncserver (RHSA-2021:1811)	Nessus	Red Hat Local Security Checks	high
142357	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2020-2362)	Nessus	Huawei Local Security Checks	high
140883	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2020-2116)	Nessus	Huawei Local Security Checks	critical
140161	EulerOS 2.0 SP5 : libvncserve (EulerOS-SA-2020-1940)	Nessus	Huawei Local Security Checks	high
140046	Debian DLA-2347-1 : libvncserver security update	Nessus	Debian Local Security Checks	medium
139141	EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2020-1811)	Nessus	Huawei Local Security Checks	high
138999	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer vulnerabilities (USN-4434-1)	Nessus	Ubuntu Local Security Checks	medium
137907	Debian DLA-2264-1 : libvncserver security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-14405

medium

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

critical

high

medium

high

medium

medium