CVE-2021-41380

{"id": "CVE-2021-41380", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-09-17T20:15:07.827", "references": [{"url": "https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang, until terminated, but no memory leak occurs - the resources are freed once the hung process is terminated and the resource usage is constant during the hang. Only the process that is connected to the fake Server is affected. This is an application bug, not a security issue"}, {"lang": "es", "value": "** EN DISPUTA ** RealVNC Viewer 6.21.406 permite que los servidores VNC remotos provoquen una denegaci\u00f3n de servicio (ca\u00edda de la aplicaci\u00f3n) a trav\u00e9s de datos de protocolo RFB manipulados. NOTA: Se afirma que este problema requiere ingenier\u00eda social para que un usuario se conecte a un servidor VNC falso. La aplicaci\u00f3n VNC Viewer que est\u00e1n utilizando se colgar\u00e1, hasta que se termine, pero no se produce ninguna fuga de memoria - los recursos se liberan una vez que el proceso colgado se termina y el uso de recursos es constante durante el cuelgue. S\u00f3lo el proceso que est\u00e1 conectado al falso servidor se ve afectado. Esto es un error de la aplicaci\u00f3n, no un problema de seguridad"}], "lastModified": "2024-11-21T06:26:10.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:realvnc:vnc_viewer:6.21.406:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1F25EA0-E650-4230-937C-E9558C85BDDE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}