TightVNC Viewer pre-auth RCE via memory corruption
Original title: TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released
Attackers execute code on Windows PCs before password prompt using crafted large screen sizes in RFB protocol; PoC released but no active exploitation confirmed.
A TightVNC Viewer vulnerability allows attackers to execute code on Windows PCs before a password prompt appears. The flaw occurs when the server announces a large screen size in the Remote Framebuffer protocol, causing the viewer to allocate insufficient memory and leading to buffer overruns during screen updates. The supplied disclosure does not establish active exploitation. The vendor patched the issue in versions 2.8.89 and 2.8.90.
Unconfirmed: exact patch date unclear as vendor notices list October 2 and October 5 updates
- Research by SSD Labs Korea includes PoC for TightVNC 2.8.88 x64
- Flaw affects the viewer component only
- Listening Mode on TCP 5500 exposes viewer without password
- Updates recommended for 2.8.89 and 2.8.90
- Attack uses return-oriented programming to launch CreateProcessW
Impact: remote code execution on Windows PC via TightVNC viewer
- 1.update to 2.8.89 or 2.8.90
- 2.disable unnecessary Listening Mode
- 3.restrict TCP port 5500 to trusted systems
- Vendors
- TightVNC
- Products
- TightVNC Viewer
- Organizations
- SSD Labs Korea
- Countries
- South Korea
From the original article
2 min read at cybersecuritynews.com
A TightVNC Viewer vulnerability can let attackers execute code on Windows PCs before a password prompt appears. Research credited to SeongJoon Cho of SSD Labs Korea includes proof-of-concept exploit code targeting TightVNC 2. 8.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.