Integer Signedness Errors in UltraVNC and TightVNC Allow Remote Code Execution
CVE-2009-0388
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%
What is CVE-2009-0388?
Multiple integer signedness errors exist in UltraVNC versions 1.0.2 and 1.0.5, as well as TightVNC version 1.3.9. These flaws can be exploited by remote VNC servers to trigger a denial of service resulting in application crashes or may allow execution of arbitrary code. The vulnerabilities are specifically related to the 'CheckBufferSize' and 'CheckFileZipBufferSize' functions in ClientConnection.cpp, where a large length value in a message can lead to heap corruption.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.