Software Engineering Institute

AT&T WinVNC is a free software package available from AT&T Labs Cambridge that allows users to interact with the desktop of a remote Windows host. By providing a specially crafted HTTP request to the VNC server, an attacker can overflow a buffer in Log.cpp, resulting in access to the VNC server and the ability to execute arbitrary code with the privileges of the user running the server. It is worth noting that the VNC server does not listen on 80/tcp by default. See the following url:

http://www.uk.research.att.com/vnc/faq.html#q52

Local and remote users can execute arbitrary code with the privileges of the user running the server.

Apply this patch while inside the vnc_winsrc/winvnc
directory:

--- Log.cpp Mon Jan 15 18:17:46 2001
+++ Log.cpp Mon Jan 15 18:18:31 2001
@@ -130,7 +130,7 @@

// - Write the log message
TCHAR line[LINE_BUFFER_SIZE];
- vsprintf(line, format, ap);
+ _vsnprintf(line, sizeof(line)-sizeof(TCHAR), format, ap);
ReallyPrintLine(line);
}