High severity · published Mar 8, 2019
CVE-2019-8277
UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure
7.5
CVSS
3%
EPSS
No
On KEV
Description
UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UL
UltraVNC · Kaspersky Lab
revision 1211 · source: vendor, NVD
SA
Sinumerik Access Mymachine/p2p · Siemens
before 4.8 · source: NVD
SP
Sinumerik Pcu Base Win10 Software/ipc · Siemens
before 14.00 · source: NVD
SP
Sinumerik Pcu Base Win7 Software/ipc · Siemens
through 12.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-8277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-8277
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
Third Party Advisory
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-024-ultravnc-improper-initialization/
us-cert.cisa.gov
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-161-06
More from UltraVNC
9.8
CVE-2019-8280
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution
9.8
CVE-2019-8275
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users
9.8
CVE-2019-8274
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution
9.8
CVE-2019-8273
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution
9.8
CVE-2019-8272
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution