An issue was discovered in libvncserver-0.9.12. There is a divide by zero in rfbSendRectEncodingRaw function in libvncserver/rfbserver.c. Attackers can launch a denial of service attack by sending a special message to the VNC server. Upstream issue: https://github.com/LibVNC/libvncserver/issues/409 Upstream commit: https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba
Acknowledgments: Name: Kailong Zhu, Hui Huang, Lu Yu
External References: https://github.com/LibVNC/libvncserver/issues/409 https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba
Created libvncserver tracking bugs for this issue: Affects: epel-7 [bug 1896740]
NOTE: at least one commercial firewall has flagged TurboVNC connections as vulnerable to this CVE, but to the best of my knowledge and testing, LibVNCServer is the only TightVNC-compatible code base that is (was) vulnerable. I was unable to reproduce the vulnerability with TightVNC 1.3.x, TigerVNC, or TurboVNC. Refer to https://github.com/TurboVNC/turbovnc/pull/273#issuecomment-784498698.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25708
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1811 https://access.redhat.com/errata/RHSA-2021:1811