Bug 1661102 (CVE-2018-15127) - CVE-2018-15127 libvncserver: Heap out-of-bounds write in rfbserver.c in rfbProcessFileTransferReadBuffer() allows for potential code execution
Summary: CVE-2018-15127 libvncserver: Heap out-of-bounds write in rfbserver.c in rfbPr...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-15127
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1661103 1661104 1662995 1662996 1662997
Blocks: 1661105
TreeView+ depends on / blocked
 
Reported: 2018-12-20 06:47 UTC by Sam Fowler
Modified: 2021-02-16 22:37 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:44:18 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0059 0 None None None 2019-01-15 09:15:01 UTC

Description Sam Fowler 2018-12-20 06:47:22 UTC 
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains a heap out-of-bound write vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in 502821828ed00b4a2c4bef90683d0fd88ce495de and later.


External Reference:

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-028-libvnc-heap-out-of-bound-write/


Upstream Patch:

https://github.com/LibVNC/libvncserver/commit/502821828ed00b4a2c4bef90683d0fd88ce495de
Comment 1 Sam Fowler 2018-12-20 06:47:35 UTC 
Created libvncserver tracking bugs for this issue:

Affects: epel-7 [bug 1661104]
Affects: fedora-all [bug 1661103]
Comment 2 Sam Fowler 2018-12-20 07:00:08 UTC 
Upstream Issue:

https://github.com/LibVNC/libvncserver/issues/243
Comment 4 Sam Fowler 2018-12-20 08:01:53 UTC 
Reference:

https://seclists.org/oss-sec/2018/q4/212
Comment 9 Petr Pisar 2019-01-10 10:03:41 UTC 
Final correction was handled in <https://github.com/LibVNC/libvncserver/pull/276>.

A complete fix for this issue consists of these three upstream commits:

commit 502821828ed00b4a2c4bef90683d0fd88ce495de
Author: Christian Beier <dontmind>
Date:   Sun Oct 21 20:21:30 2018 +0200

    LibVNCServer: fix heap out-of-bound write access
    
    Closes #243

commit 15bb719c03cc70f14c36a843dcb16ed69b405707
Author: Christian Beier <dontmind>
Date:   Sun Jan 6 15:13:56 2019 +0100

    Error out in rfbProcessFileTransferReadBuffer if length can not be allocated
    
    re #273

commit 09e8fc02f59f16e2583b34fe1a270c238bd9ffec
Author: Petr Písař <ppisar>
Date:   Mon Jan 7 10:40:01 2019 +0100

    Limit lenght to INT_MAX bytes in rfbProcessFileTransferReadBuffer()
    
    This ammends 15bb719c03cc70f14c36a843dcb16ed69b405707 fix for a heap
    out-of-bound write access in rfbProcessFileTransferReadBuffer() when
    reading a transfered file content in a server. The former fix did not
    work on platforms with a 32-bit int type (expected by rfbReadExact()).
    
    CVE-2018-15127
    <https://github.com/LibVNC/libvncserver/issues/243>
    <https://github.com/LibVNC/libvncserver/issues/273>
Comment 10 errata-xmlrpc 2019-01-15 09:14:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0059 https://access.redhat.com/errata/RHSA-2019:0059
Note You need to log in before you can comment on or make changes to this bug.