Software Engineering Institute

Overview

A heap-based buffer overflow exists in the Tight JPEG decoding component of the TightVNC Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. An attacker controlling a malicious VNC server can trigger memory corruption by sending a specially crafted screen update. Successful exploitation can crash the viewer and may allow arbitrary code execution, although only denial of service conditions were demonstrated during testing.

Description

TightVNC and UltraVNC provide remote desktop access using the Remote Framebuffer (RFB) protocol. Their viewer applications connect to VNC servers and decode screen updates for local display. Tight encoding supports JPEG compression of image data within these updates.

The Windows viewer function DecompressJpegRect() allocates a heap buffer using a hardcoded maximum row width of 8,192 pixels but converts JPEG pixel data using the server-supplied rectangle width without adequately checking that the output fits within the buffer. A malicious server can supply an oversized Tight JPEG rectangle that causes the conversion loop to write beyond the allocated memory. In an allocation demonstrated during testing, which included 256 bytes of padding, the out-of-bounds write began at a rectangle width of 8,257 pixels.

Exploitation requires a vulnerable viewer to establish a session with an attacker-controlled or compromised VNC server and process its crafted update. The server can advertise a sufficiently large framebuffer, so checking that the rectangle fits within the advertised framebuffer does not, by itself, prevent this overflow. Authentication or transport encryption does not prevent exploitation by a malicious server participating in the session.

Impact

An attacker controlling a VNC server can corrupt heap memory in a connected vulnerable viewer, terminating the application and interrupting the remote desktop session. Memory corruption may also permit arbitrary code execution with the privileges of the user running the viewer, but only denial of service was confirmed during testing.

Solution

Review the Vendor Information section for product-specific patch information.

According to UltraVNC’s release notes, the Tight JPEG heap overflow vulnerability was addressed in version 1.8.2.8. Users should upgrade to a current supported release containing that fix, such as version 1.8.3.1.

Unfortunately, we were unable to reach TightVNC to coordinate a fix for the affected 1.3.10 Windows viewer. Users should replace affected viewers with a maintained version or an alternative solution that has been confirmed to address the vulnerability.

Until a corrected viewer is deployed, restrict connections to trusted VNC servers only. This reduces exposure but does not protect against a compromised trusted server.

Acknowledgements

Thank you to re9rch for reporting this vulnerability. This document was written by Michael Bragg.

Vendor Information