Pre-authentication flaw in TightVNC Viewer enables remote code execution
A researcher at SSD Labs Korea demonstrated remote code execution in TightVNC Viewer 2.8.88 x64 through a malicious RFB server that advertises a screen of 32768 by 32769 at 32bpp. The flaw is exploitable before authentication; in Listening Mode the Viewer accepts connections on 0.0.0.0:5500 with no IP or password restrictions. The source states no fix: avoid connecting the Viewer to unknown servers and protect port 5500.
What happened
A researcher at SSD Labs Korea demonstrated that TightVNC Viewer 2.8.88 x64 allows a malicious server to run code on the machine before any password prompt. In Listening Mode the program accepts connections on port 5500 with no IP or password restrictions.
Why it matters
An attacker who can reach port 5500 or control the server an employee connects to can run commands on the machine without user interaction. Remote access and technical support, scenarios cited by the source, become the attacker's way in.
What to do
Block external access to port 5500, tell staff not to connect the Viewer to unknown servers, including technical support servers, and check with the vendor whether a fixed version exists.
For the technical team
- Affected
- TightVNC Viewer 2.8.88 x64 · TightVNC Viewer 2.8.88 x64.
- Exploitation
- Proof of concept demonstrated by SeongJoon Cho of SSD Labs Korea. No in-the-wild exploitation reported in the source.
- Fix
- Source states no fix. The passage on the vendor response is cut off ('the vendor fi'), with no verifiable content.
- Vector
- FrameBuffer::getBufferSize in TightVNC Viewer computes the size with 64-bit arithmetic, casts the result to a 32-bit int and allocates 128 KB instead of more than 4 GB; getBufferPtr computes 32-bit offsets without checking the allocated buffer, allowing writes beyond the framebuffer with attacker-controlled positive and negative offsets. Trigger: a malicious RFB server advertising a screen of 32768 x 32769 at 32bpp. Pre-authentication exploitation: the Viewer does not authenticate the server and accepts the None security type. In Listening Mode (tvnviewer.exe -listen) it listens on 0.0.0.0:5500 with no IP or password restrictions, giving RCE without user interaction.
- More details
- Exploit chain: to bypass ASLR it overwrites m_dataLength in a BufferedOutputStream object and forces flush to send adjacent heap regions back through the socket, leaking pointers that reveal the base of tvnviewer.exe; it then places a fake object and a ROP chain in the buffer, overwrites the BufferedOutputStream vtable pointer and uses a virtual call to pivot the stack into the framebuffer; the ROP chain calls CreateProcessW. On outbound connections, compromise happens when connecting to an attacker-controlled server, including a fake technical support server or a hijacked port, before the password prompt.
Timeline
Incident opened.
Sources 1 source
- @ptdbugs @ptdbugs
