Updated libvncserver packages fix security vulnerabilities :

A malicious VNC server can trigger incorrect memory management handling by advertising a large screen size parameter to the VNC client. This would result in multiple memory corruptions and could allow remote code execution on the VNC client (CVE-2014-6051, CVE-2014-6052).

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054).

A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055).

Additionally libvncserver has been built against the new system minilzo library which is also being provided with this advisory.

The LibVNCServer package was updated to fix the following security issues :

  - bsc#897031: fix several security issues :

  - CVE-2014-6051: Integer overflow in MallocFrameBuffer()     on client side.

  - CVE-2014-6052: Lack of malloc() return value checking on     client side.

  - CVE-2014-6053: Server crash on a very large     ClientCutText message.

  - CVE-2014-6054: Server crash when scaling factor is set     to zero.

  - CVE-2014-6055: Multiple stack overflows in File Transfer     feature.

  - bsc#854151: Restrict the SSL cipher suite.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way screen sizes were handled by LibVNCServer. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code in the client. (CVE-2014-6051)

A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash. (CVE-2014-6052)

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. (CVE-2014-6053)

A divide-by-zero flaw was found in the way LibVNCServer handled the scaling factor when it was set to '0'. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client.
(CVE-2014-6054)

Two stack-based buffer overflow flaws were found in the way LibVNCServer handled file transfers. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client.
(CVE-2014-6055)

All running applications linked against libvncserver must be restarted for this update to take effect.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2365-1 advisory.

    Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when being advertised large screen     sizes by the server. If a user were tricked into connecting to a malicious server, an attacker could use     this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2014-6051,     CVE-2014-6052)

    Nicolas Ruff discovered that LibVNCServer incorrectly handled large ClientCutText messages. A remote     attacker could use this issue to cause a server to crash, resulting in a denial of service.
    (CVE-2014-6053)

    Nicolas Ruff discovered that LibVNCServer incorrectly handled zero scaling factor values. A remote     attacker could use this issue to cause a server to crash, resulting in a denial of service.
    (CVE-2014-6054)

    Nicolas Ruff discovered that LibVNCServer incorrectly handled memory in the file transfer feature. A     remote attacker could use this issue to cause a server to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2014-6055)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various security fixes, including CVE-2014-6051, CVE-2014-6052, CVE-2014-6053, CVE-2014-6054, CVE-2014-6055

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in libvncserver, a library to implement VNC server functionality. These vulnerabilities might result in the execution of arbitrary code or denial of service in both the client and the server side.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79589	Mandriva Linux Security Advisory : libvncserver (MDVSA-2014:229)	Nessus	Mandriva Local Security Checks	2014/11/27	2021/1/6	high
87389	openSUSE Security Update : LibVNCServer (openSUSE-2015-851)	Nessus	SuSE Local Security Checks	2015/12/16	2021/1/19	high
79230	Scientific Linux Security Update : libvncserver on SL6.x, SL7.x i386/x86_64 (20141111)	Nessus	Scientific Linux Local Security Checks	2014/11/13	2021/1/14	high
77982	Ubuntu 14.04 LTS : LibVNCServer vulnerabilities (USN-2365-1)	Nessus	Ubuntu Local Security Checks	2014/9/30	2024/8/27	critical
78000	Fedora 21 : libvncserver-0.9.10-0.6.20140718git9453be42.fc21 (2014-11685)	Nessus	Fedora Local Security Checks	2014/10/1	2021/1/11	high
79629	Debian DSA-3081-1 : libvncserver - security update	Nessus	Debian Local Security Checks	2014/12/1	2021/1/11	high

检测

插件搜索

high

high

high

critical

high

high