Integer Overflow and Heap-Based Buffer Overflow in LibVNCServer (CVE-2019-20788)
Summary
CVE-2019-20788: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. Affects libvncserver across 2 version ranges.
< 0.9.12+dfsg-9
< 54220248886b5001fbbb9fa73c4e1a2cb9413fed
Fixed in 0.9.12+dfsg-9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibVNCServer is an open-source implementation of the Virtual Network Computing (VNC) protocol, allowing remote access to graphical user interfaces. It is widely used in various applications for remote desktop sharing and control. The package is designed to be lightweight and efficient, making it suitable for both server and client implementations. However, it has been found to be vulnerable to an integer overflow and heap-based buffer overflow, which can lead to severe security issues.
Vulnerability Detail
The vulnerability identified as CVE-2019-20788 arises from an integer overflow in the HandleCursorShape function located in the cursor.c file of LibVNCServer versions up to 0.9.12. This overflow can occur when large height or width values are processed, potentially leading to a heap-based buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code, resulting in a complete compromise of the affected system. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to systems utilizing the affected versions of the package.
How To Fix
Minimum fixed version
0.9.12+dfsg-9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvncserverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the VNC server to trusted IP addresses only, thereby minimizing the risk of exploitation until the package is updated. Additionally, disabling the VNC service when not in use can help mitigate potential attacks.
Conclusion
CVE-2019-20788 represents a significant security risk for users of LibVNCServer versions prior to 0.9.12. It is crucial for users to update their installations promptly to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help in monitoring for vulnerabilities in open-source software effectively.
See every vulnerability recorded for libvncserver →
FAQ
CVE-2019-20788 is a vulnerability in LibVNCServer that allows for an integer overflow and heap-based buffer overflow, potentially leading to arbitrary code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring code access.
Exploitation of this vulnerability can lead to arbitrary code execution, allowing attackers to take control of the affected system, steal data, or disrupt services.
Yes, you can restrict access to the VNC server and disable it when not in use to reduce the risk of exploitation until an update is applied.
The CVSS score of CVE-2019-20788 is 9.8, indicating a critical level of risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libvncserver.
