UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially result code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1207.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf | Third Party Advisory |
| https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-015-ultravnc-off-by-one-error/ | Third Party Advisory |
| https://www.us-cert.gov/ics/advisories/icsa-20-161-06 | Third Party Advisory US Government Resource |
| https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf | Third Party Advisory |
| https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-015-ultravnc-off-by-one-error/ | Third Party Advisory |
| https://www.us-cert.gov/ics/advisories/icsa-20-161-06 | Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 04:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf - Third Party Advisory | |
| References | () https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-015-ultravnc-off-by-one-error/ - Third Party Advisory | |
| References | () https://www.us-cert.gov/ics/advisories/icsa-20-161-06 - Third Party Advisory, US Government Resource |
Information
Published : 2019-03-08 23:29
Updated : 2024-11-21 04:49
NVD link : CVE-2019-8268
Mitre link : CVE-2019-8268
CVE.ORG link : CVE-2019-8268
JSON object : View
Products Affected
siemens
- sinumerik_pcu_base_win7_software\/ipc
- sinumerik_access_mymachine\/p2p
- sinumerik_pcu_base_win10_software\/ipc
uvnc
- ultravnc
CWE
CWE-193
Off-by-one Error