Vulnerabilities > CVE-2017-5581 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Tigervnc

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
tigervnc
CWE-119
nessus

Summary

Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0630.NASL
    descriptionFrom Red Hat Security Advisory 2017:0630 : An update for tigervnc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. The tigervnc packages contain a client which allows users to connect to other desktops running a VNC server. Security Fix(es) : * A denial of service flaw was found in the TigerVNC
    last seen2020-06-01
    modified2020-06-02
    plugin id99065
    published2017-03-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99065
    titleOracle Linux 6 : tigervnc (ELSA-2017-0630)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2017:0630 and 
    # Oracle Linux Security Advisory ELSA-2017-0630 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(99065);
      script_version("3.4");
      script_cvs_date("Date: 2019/09/27 13:00:37");
    
      script_cve_id("CVE-2016-10207", "CVE-2017-5581");
      script_xref(name:"RHSA", value:"2017:0630");
    
      script_name(english:"Oracle Linux 6 : tigervnc (ELSA-2017-0630)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2017:0630 :
    
    An update for tigervnc is now available for Red Hat Enterprise Linux
    6.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Virtual Network Computing (VNC) is a remote display system which
    allows users to view a computing desktop environment not only on the
    machine where it is running, but from anywhere on the Internet and
    from a wide variety of machine architectures. TigerVNC is a suite of
    VNC servers and clients. The tigervnc packages contain a client which
    allows users to connect to other desktops running a VNC server.
    
    Security Fix(es) :
    
    * A denial of service flaw was found in the TigerVNC's Xvnc server. A
    remote unauthenticated attacker could use this flaw to make Xvnc crash
    by terminating the TLS handshake process early. (CVE-2016-10207)
    
    * A buffer overflow flaw, leading to memory corruption, was found in
    TigerVNC viewer. A remote malicious VNC server could use this flaw to
    crash the client vncviewer process resulting in denial of service.
    (CVE-2017-5581)
    
    Additional Changes :
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9
    Technical Notes linked from the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2017-March/006799.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected tigervnc packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:tigervnc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:tigervnc-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:tigervnc-server-applet");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:tigervnc-server-module");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/02/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/03/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"tigervnc-1.1.0-24.el6")) flag++;
    if (rpm_check(release:"EL6", reference:"tigervnc-server-1.1.0-24.el6")) flag++;
    if (rpm_check(release:"EL6", reference:"tigervnc-server-applet-1.1.0-24.el6")) flag++;
    if (rpm_check(release:"EL6", reference:"tigervnc-server-module-1.1.0-24.el6")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tigervnc / tigervnc-server / tigervnc-server-applet / etc");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201702-19.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201702-19 (TigerVNC: Buffer overflow) A buffer overflow vulnerability in ModifiablePixelBuffer::fillRect in vncviewer was found. Impact : A remote attacker, utilizing a malicious VNC server, could execute arbitrary code with the privileges of the user running the client or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id97262
    published2017-02-21
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97262
    titleGLSA-201702-19 : TigerVNC: Buffer overflow
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1228.NASL
    descriptionAccording to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the TigerVNC
    last seen2020-05-06
    modified2017-09-11
    plugin id103086
    published2017-09-11
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103086
    titleEulerOS 2.0 SP2 : tigervnc (EulerOS-SA-2017-1228)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170321_TIGERVNC_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - A denial of service flaw was found in the TigerVNC
    last seen2020-03-18
    modified2017-04-06
    plugin id99227
    published2017-04-06
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99227
    titleScientific Linux Security Update : tigervnc on SL6.x i386/x86_64 (20170321)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0106_TIGERVNC.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has tigervnc packages installed that are affected by multiple vulnerabilities: - A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service. (CVE-2017-5581) - A denial of service flaw was found in the TigerVNC
    last seen2020-06-01
    modified2020-06-02
    plugin id127339
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127339
    titleNewStart CGSL MAIN 4.05 : tigervnc Multiple Vulnerabilities (NS-SA-2019-0106)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-879.NASL
    descriptionBuffer overflow in ModifiablePixelBuffer::fillRect A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service. (CVE-2017-5581) VNC server can crash when TLS handshake terminates early : A denial of service flaw was found in the TigerVNC
    last seen2020-06-01
    modified2020-06-02
    plugin id102867
    published2017-09-01
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/102867
    titleAmazon Linux AMI : tigervnc (ALAS-2017-879)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-2000.NASL
    descriptionFrom Red Hat Security Advisory 2017:2000 : An update for tigervnc and fltk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients which allows users to connect to other desktops running a VNC server. FLTK (pronounced
    last seen2020-06-01
    modified2020-06-02
    plugin id102293
    published2017-08-09
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102293
    titleOracle Linux 7 : fltk / tigervnc (ELSA-2017-2000)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-2000.NASL
    descriptionAn update for tigervnc and fltk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients which allows users to connect to other desktops running a VNC server. FLTK (pronounced
    last seen2020-06-01
    modified2020-06-02
    plugin id102748
    published2017-08-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102748
    titleCentOS 7 : fltk / tigervnc (CESA-2017:2000)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0630.NASL
    descriptionAn update for tigervnc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. The tigervnc packages contain a client which allows users to connect to other desktops running a VNC server. Security Fix(es) : * A denial of service flaw was found in the TigerVNC
    last seen2020-06-01
    modified2020-06-02
    plugin id97953
    published2017-03-27
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97953
    titleCentOS 6 : tigervnc (CESA-2017:0630)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170801_TIGERVNC_AND_FLTK_ON_SL7_X.NASL
    descriptionFLTK (pronounced
    last seen2020-03-18
    modified2017-08-22
    plugin id102658
    published2017-08-22
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102658
    titleScientific Linux Security Update : tigervnc and fltk on SL7.x x86_64 (20170801)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-2000.NASL
    descriptionAn update for tigervnc and fltk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients which allows users to connect to other desktops running a VNC server. FLTK (pronounced
    last seen2020-06-01
    modified2020-06-02
    plugin id102109
    published2017-08-02
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102109
    titleRHEL 7 : tigervnc and fltk (RHSA-2017:2000)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0630.NASL
    descriptionAn update for tigervnc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. The tigervnc packages contain a client which allows users to connect to other desktops running a VNC server. Security Fix(es) : * A denial of service flaw was found in the TigerVNC
    last seen2020-06-01
    modified2020-06-02
    plugin id97876
    published2017-03-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97876
    titleRHEL 6 : tigervnc (RHSA-2017:0630)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1227.NASL
    descriptionAccording to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the TigerVNC
    last seen2020-05-06
    modified2017-09-11
    plugin id103085
    published2017-09-11
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103085
    titleEulerOS 2.0 SP1 : tigervnc (EulerOS-SA-2017-1227)

Redhat

advisories
  • bugzilla
    id1418761
    titleCVE-2016-10207 tigervnc: VNC server can crash when TLS handshake terminates early
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commenttigervnc-server-module is earlier than 0:1.1.0-24.el6
            ovaloval:com.redhat.rhsa:tst:20170630001
          • commenttigervnc-server-module is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110871008
        • AND
          • commenttigervnc-server-applet is earlier than 0:1.1.0-24.el6
            ovaloval:com.redhat.rhsa:tst:20170630003
          • commenttigervnc-server-applet is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110871002
        • AND
          • commenttigervnc-server is earlier than 0:1.1.0-24.el6
            ovaloval:com.redhat.rhsa:tst:20170630005
          • commenttigervnc-server is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110871004
        • AND
          • commenttigervnc is earlier than 0:1.1.0-24.el6
            ovaloval:com.redhat.rhsa:tst:20170630007
          • commenttigervnc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110871006
    rhsa
    idRHSA-2017:0630
    released2017-03-21
    severityModerate
    titleRHSA-2017:0630: tigervnc security and bug fix update (Moderate)
  • rhsa
    idRHSA-2017:2000
rpms
  • tigervnc-0:1.1.0-24.el6
  • tigervnc-debuginfo-0:1.1.0-24.el6
  • tigervnc-server-0:1.1.0-24.el6
  • tigervnc-server-applet-0:1.1.0-24.el6
  • tigervnc-server-module-0:1.1.0-24.el6
  • fltk-0:1.3.4-1.el7
  • fltk-debuginfo-0:1.3.4-1.el7
  • fltk-devel-0:1.3.4-1.el7
  • fltk-fluid-0:1.3.4-1.el7
  • fltk-static-0:1.3.4-1.el7
  • tigervnc-0:1.8.0-1.el7
  • tigervnc-debuginfo-0:1.8.0-1.el7
  • tigervnc-icons-0:1.8.0-1.el7
  • tigervnc-license-0:1.8.0-1.el7
  • tigervnc-server-0:1.8.0-1.el7
  • tigervnc-server-applet-0:1.8.0-1.el7
  • tigervnc-server-minimal-0:1.8.0-1.el7
  • tigervnc-server-module-0:1.8.0-1.el7