----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
UltraVNC vncviewer "ClientConnection::NegotiateProtocolVersion()"
Buffer Overflow

SECUNIA ADVISORY ID:
SA28747

VERIFY ADVISORY:
http://secunia.com/advisories/28747/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
UltraVNC (formerly Ultr@VNC) 1.x
http://secunia.com/product/2836/

DESCRIPTION:
A vulnerability has been discovered in UltraVNC, which can be
exploited by malicious people to compromise a user's system.

The vulnerability is caused due the
"ClientConnection::NegotiateProtocolVersion()" function in
vncviewer/ClientConnection.cpp using user-supplied length values to
copy data without proper bounds checking. This can be exploited to
cause a stack-based buffer overflow by e.g. sending specially crafted
data to a vncviewer in "LISTENING" mode or by tricking a user into
connecting to a malicious VNC server.

Successful exploitation allows execution of arbitrary code.

This may also be exploited if a DSM plugin is used, but requires that
the attacker owns the encryption key used by vncviewer.

The vulnerability is confirmed in version 1.0.2 and reported in
release candidates of version 1.0.4 prior to January 25th, 2008.
Reportedly, UltraVNC server is not affected.

SOLUTION:
Apply updated version.
http://downloads.sourceforge.net/ultravnc/UltraVNC-Viewer-104-Security-Update.zip

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://forum.ultravnc.info/viewtopic.php?t=11850

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------