EIP-5182fb5b
A vulnerability exists within UltraVNC view due to a lack of proper stack memory buffer cleanup before constructing the ‘rfbTextChat’ message, which results in a leak of 3-bytes of stack memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the UltraVNC Viewer process.
Vulnerability Identifiers
Exodus Intelligence: EIP-5182fb5b
MITRE CVE:
Vulnerability Metrics
CVSSv2 Score: 4.3
Vendor References
https://github.com/ultravnc/UltraVNC/releases/tag/1.3.4
Discovery Credit
Exodus Intelligence
Disclosure Timeline
Disclosed to affected vendor: June 21th, 2021
Disclosed to public: September 25th, 2021
Further Information
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.
The post UltraVNC Viewer VNC client Remote Memory Leak Vulnerability appeared first on Exodus Intelligence.
Support the originator by clicking the read the rest link below.
