Full Report
UltraVNC Viewer before 1.2.2.4 has an out-of-bounds read vulnerability inside client CoRRE decoder, caused by multiplication overflow.
Analysis Summary
# Vulnerability: UltraVNC Viewer CoRRE Decoder Out-of-Bounds Read
## CVE Details
- **CVE ID:** CVE-2019-8261
- **CVSS Score:** 6.5 (Medium) *Note: While the provided text lists a base of 0.0, the calculation string provided (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) evaluates to 6.5.*
- **CWE:** CWE-125 (Out-of-bounds Read) / CWE-190 (Integer Overflow)
## Affected Systems
- **Products:** UltraVNC Viewer
- **Versions:** All versions prior to 1.2.2.4
- **Configurations:** Systems utilizing the Compact RRE (CoRRE) video decoding logic during a VNC session.
## Vulnerability Description
UltraVNC Viewer contains a flaw within its client-side CoRRE decoder. The vulnerability is triggered by a multiplication overflow when calculating buffer sizes or offsets during the processing of CoRRE-encoded data sent from a VNC server. This overflow leads to an out-of-bounds (OOB) read, where the application attempts to access memory outside of the intended buffer.
## Exploitation
- **Status:** Proof of Concept (PoC) available
- **Complexity:** Low
- **Attack Vector:** Network
- **Requirement:** Successful exploitation requires a user to connect their UltraVNC Viewer to a malicious or compromised VNC server controlled by the attacker.
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Can result in a Denial-of-Service condition via application crash)
## Remediation
### Patches
- **UltraVNC 1.2.2.4:** This version (released February 2019) contains the fix for the multiplication overflow. Users should upgrade to this version or any subsequent release.
### Workarounds
- **Session Restriction:** Connect only to trusted VNC servers and avoid using the viewer to access unknown or public VNC instances.
- **Protocol Configuration:** If possible, disable the CoRRE encoding option in the viewer's connection settings, though this may impact performance or compatibility.
## Detection
- **Indicators of Compromise:** Unexpected crashes of the `vncviewer.exe` process specifically when establishing a connection or during active screen updates.
- **Detection Methods:**
- Use software inventory tools to identify versions of UltraVNC older than 1.2.2.4.
- Network intrusion detection systems (IDS) may be configured to scan for Malformed VNC RFB (Remote Framebuffer) protocol traffic.
## References
- **Kaspersky ICS CERT Advisory:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2019/03/01/klcert-19-007-ultravnc-out-of-bound-read/
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2019-8261
- **UltraVNC Official Site:** hxxp[://]www[.]uvnc[.]com/