CVE-2009-0388

TightVNC - Authentication Failure Integer Overflow (PoC)

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.

Errores múltiples de signo de entero en (1) UltraVNC v1.0.2 y v1.0.5 y (2) TightVnc v1.3.9 permiten a atacantes remotos provocar una denegación de servicio (corrupción de la cabecera y caída de la aplicación) o posiblemente ejecutar codigo de su elección mediante un valor de gran longitud en un mensaje, en relación con las funciones (a) ClientConnection::CheckBufferSize y (b) ClientConnection::CheckFileZipBufferSize en ClientConnection.cpp.

*Credits: N/A

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-02-02 CVE Reserved
2009-02-03 CVE Published
2023-05-10 EPSS Updated
2024-08-07 CVE Updated
2024-08-07 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-189: Numeric Errors

CAPEC

References (10)

URL	Tag	Source
http://forum.ultravnc.info/viewtopic.php?t=14654	X_refsource_confirm
http://secunia.com/advisories/33807	Third Party Advisory
http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564	X_refsource_confirm
http://www.securityfocus.com/archive/1/500632/100/0/threaded	Mailing List
http://www.vupen.com/english/advisories/2009/0321	Vdb Entry
http://www.vupen.com/english/advisories/2009/0322	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/8024	2024-08-07
https://www.exploit-db.com/exploits/7990	2024-08-07
http://www.coresecurity.com/content/vnc-integer-overflows	2024-08-07
http://www.securityfocus.com/bid/33568	2024-08-07

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tightvnc Search vendor "Tightvnc"		Tightvnc Search vendor "Tightvnc" for product "Tightvnc"				1.3.9 Search vendor "Tightvnc" for product "Tightvnc" and version "1.3.9"		-		Affected
Ultravnc Search vendor "Ultravnc"		Ultravnc Search vendor "Ultravnc" for product "Ultravnc"				1.0.2 Search vendor "Ultravnc" for product "Ultravnc" and version "1.0.2"		-		Affected
Ultravnc Search vendor "Ultravnc"		Ultravnc Search vendor "Ultravnc" for product "Ultravnc"				1.0.5 Search vendor "Ultravnc" for product "Ultravnc" and version "1.0.5"		-		Affected