UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC...
Vulnerability Description
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-8259
Credits & Attribution
No credits recorded in the NVD database.
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-005-ultravnc-memory-leak/
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06
- https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
More from UltraVNC
View All →Affected Vendor
UltraVNC
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.