Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against UltraVNC VNCViewer Authenticate Buffer Overflow

Subscribe

Check Point Reference: CPAI-2009-055
Date Published:
Severity:
Source: Secunia Advisory: SA33794
Industry Reference(s): CVE-2009-0388
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
UltraVNC UltraVNC 1.0.5.3 and priors
Vulnerability Description
A buffer overflow vulnerability was reported in multiple Virtual Network Computing (VNC) based applications. Virtual Network Computing (VNC) is a graphical desktop sharing technology desigend to remotely control another computer. The flaw is due to improper validation of length value in network messages. A remote attacker can trigger this vulnerability by persuading the target user to connect to a malicious VNC server.
Update/Patch Available
The problem has been fixed in the SVN repository.
http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564
Vulnerability Details
The vulnerabilities are caused due to signedness errors within several functions including ClientConnection::CheckBufferSize()" and "ClientConnection::CheckFileZipBufferSize()". A remote attacker could trigger the vulnerability using a crafted, unusually long network message.

Protection Overview
By enabling this protection, IPS-1 will detect and block VNC authentication responses that are unusually long.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Security > VNC Remote Framebuffer Protocol, and select the VNC Alerts protection group
3. Click VNC Long Authentication Failure Reason Alert (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: VNC Alert Source
Description: VNC Long Authentication Failure Reason Alert