UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
UltraVNC, en su revisión 1211, tiene una vulnerabilidad de error por un paso en el código del servidor VNC, lo que podría resultar, potencialmente, en la ejecución de código. Este ataque parece ser explotable mediante la conectividad de red. Se han solucionado estas vulnerabilidades en la revisión 1212.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-193
|
| [email protected] | Primary |
en
CWE-193
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| uvnc | ultravnc | * | <built-in method update of dict object at 0x7e60bbd628c0> | Application |
| siemens | sinumerik_access_mymachine\/p2p | * | <built-in method update of dict object at 0x7e60b8479180> | Application |
| siemens | sinumerik_pcu_base_win10_software\/ipc | * | <built-in method update of dict object at 0x7e60b847a340> | Application |
| siemens | sinumerik_pcu_base_win7_software\/ipc | * | <built-in method update of dict object at 0x7e6107468980> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinumerik_access_mymachine\/p2p:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinumerik_pcu_base_win10_software\/ipc:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinumerik_pcu_base_win7_software\/ipc:*:*:*:*:*:*:*:* |