VU#644655: TightVNC and UltraVNC Viewer contains a heap-based buffer overflow
Overview A heap-based buffer overflow exists in the Tight JPEG decoding component of the TightVNC Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. An attacker controlling a malicious VNC server can trigger memory corruption by sending a specially crafted screen update. Successful exploitation can crash the viewer and may allow arbitrary code execution, although only denial of service conditions were demonstrated during testing. Description TightVNC and UltraVNC provide remote desktop access using the Remote Framebuffer (RFB) protocol. Their viewer applications connect to VNC servers and decode screen updates for local display. Tight encoding supports JPEG compression of image data within these updates. The Windows viewer function DecompressJpegRect() allocates a heap buffer using a hardcoded maximum row width of 8,192 pixels but converts JPEG pixel data using the server-supplied rectangle width without adequately checking that the output fits within the buffer. A ma
Continue on CERT/CC Vulnerability Notes ↗ ‹ All news Get the newsletter