Denial of Service Vulnerability in GNOME Vino
Summary
CVE-2013-5745: The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection... Affects vino versions < 3.10.1-1. Fixed in 3.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNOME Vino is a remote desktop server for the GNOME desktop environment. It allows users to remotely access and control their GNOME desktop from another computer. The Vino server is responsible for handling incoming remote desktop connections. It supports various authentication methods to ensure secure access. However, a vulnerability has been discovered in versions 2.26.1, 2.32.1, 3.7.3, and earlier, as well as version 3.8 when encryption is disabled.
Vulnerability Detail
The vulnerability, identified as CVE-2013-5745, exists in the vino_server_client_data_pending function in vino-server.c. When an error occurs during authentication and causes the connection to close, the function fails to properly clear client data. This flaw can be exploited by remote attackers to launch a denial of service attack against the Vino server. By sending multiple crafted requests during authentication, an attacker can trigger an infinite loop, leading to excessive CPU and disk consumption.
How To Fix
Minimum fixed version
3.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vinoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the vino package is not immediately possible, a temporary workaround can be implemented by disabling the Vino server or enabling encryption. Disabling the server will prevent remote desktop connections and eliminate the risk of exploitation. Enabling encryption adds an additional layer of security and mitigates the vulnerability.
Conclusion
The vulnerability in GNOME Vino can be exploited to launch a denial of service attack by causing excessive CPU and disk consumption. It is crucial to update the vino package to version 3.10.1-1 or later to mitigate this vulnerability. If immediate updating is not possible, disabling the Vino server or enabling encryption can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vino →
FAQ
GNOME Vino is a remote desktop server for the GNOME desktop environment, allowing users to access their GNOME desktop remotely.
Versions 2.26.1, 2.32.1, 3.7.3, and earlier, as well as version 3.8 when encryption is disabled, are affected.
The vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU and disk resources on the affected system.
Updating the vino package to version 3.10.1-1 or later will fix the vulnerability. Alternatively, you can disable the Vino server or enable encryption as a temporary workaround.
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for vino.
