A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvncserver: information disclosure and ASLR bypass (CVE-2019-15681)

  - libvncserver: libvncserver/rre.c allows out-of-bounds access via encodings (CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3125 advisory.

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

  - libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().
    (CVE-2020-29260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2020:14549-1 advisory.

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1811 advisory.

    - Fix CVE-2020-25708       Resolves: #1898078
    - Fix CVE-2019-20839       Resolves: #1851032
    - Fix CVE-2018-21247       Resolves: #1852516
    - Fix CVE-2020-14405       Resolves: #1860527

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1811 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

    * libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

    * libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

    * libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

    * libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in ultra.c in LibVNCClient     in LibVNCServer before 0.9.11 allows remote servers to     cause a denial of service (application crash) or     possibly execute arbitrary code via a crafted     FramebufferUpdate message with the Ultra type tile,     such that the LZO payload decompressed length exceeds     what is specified by the tile     dimensions.(CVE-2016-9942)

  - It was discovered that websockets.c in LibVNCServer     prior to 0.9.12 did not properly decode certain     WebSocket frames. A malicious attacker could exploit     this by sending specially crafted WebSocket frames to a     server, causing a heap-based buffer     overflow.(CVE-2017-18922)

  - LibVNC commit before     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a     memory leak (CWE-655) in VNC server code, which allow     an attacker to read stack memory and can be abused for     information disclosure. Combined with another     vulnerability, it can be used to leak stack memory and     bypass ASLR. This attack appear to be exploitable via     network connectivity. These vulnerabilities have been     fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.(CVE-2019-1568     1)

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/ws_decode.c can lead to a crash because of     unaligned accesses in     hybiReadAndDecode.(CVE-2019-20840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

  - CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c     has a divide by zero which could result in DoS

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4636-1 advisory.

    It was discovered that LibVNCServer incorrectly handled certain internals. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS.

    Vino package ships with a LibVNCServer source and all listed releases were affected for this package.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue has been found in libvncserver, an API to write one's own VNC server. Due to some missing checks, a divide by zero could happen, which could result in a denial of service.

For Debian 9 stretch, this problem has been fixed in version 0.9.11+dfsg-1.3~deb9u6.

We recommend that you upgrade your libvncserver packages.

For the detailed security status of libvncserver please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libvncserver

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199441	RHEL 8 : vino (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196364	RHEL 6 : libvncserver (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196314	RHEL 7 : libvncserver (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184742	Rocky Linux 8 : libvncserver (RLSA-2021:1811)	Nessus	Rocky Linux Local Security Checks	high
165593	Debian DLA-3125-1 : libvncserver - LTS security update	Nessus	Debian Local Security Checks	high
160737	NewStart CGSL MAIN 6.02 : libvncserver Multiple Vulnerabilities (NS-SA-2022-0048)	Nessus	NewStart CGSL Local Security Checks	high
157648	AlmaLinux 8 : libvncserver (ALSA-2021:1811)	Nessus	Alma Linux Local Security Checks	high
150527	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2020:14549-1)	Nessus	SuSE Local Security Checks	high
149968	Oracle Linux 8 : libvncserver (ELSA-2021-1811)	Nessus	Oracle Linux Local Security Checks	high
149728	CentOS 8 : libvncserver (CESA-2021:1811)	Nessus	CentOS Local Security Checks	high
149663	RHEL 8 : libvncserver (RHSA-2021:1811)	Nessus	Red Hat Local Security Checks	high
148083	EulerOS 2.0 SP5 : libvncserver (EulerOS-SA-2021-1688)	Nessus	Huawei Local Security Checks	high
146731	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2021-1321)	Nessus	Huawei Local Security Checks	critical
145732	EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2021-1153)	Nessus	Huawei Local Security Checks	high
145206	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2021-1091)	Nessus	Huawei Local Security Checks	critical
143764	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:3550-1)	Nessus	SuSE Local Security Checks	high
143668	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:3515-1)	Nessus	SuSE Local Security Checks	high
143345	openSUSE Security Update : LibVNCServer (openSUSE-2020-2025)	Nessus	SuSE Local Security Checks	high
143328	openSUSE Security Update : LibVNCServer (openSUSE-2020-2097)	Nessus	SuSE Local Security Checks	high
142998	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer, Vino vulnerability (USN-4636-1)	Nessus	Ubuntu Local Security Checks	high
142924	Debian DLA-2451-1 : libvncserver security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-25708

high

Tenable Plugins

high

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high