リモートのOracle Linux 7ホストに、ELSA-2020-3875アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 1.10.1以前のTigerVNCバージョンは、スタックのuse-after-returnに対して脆弱です。これは、ZRLEDecoderのスタックメモリの不適切な使用により発生します。デコードルーチンが例外をスローする場合、ZRLEDecoderがスタック変数にアクセスしようとする可能性があります。これは、スタックアンワインディングのプロセスですでに解放されています。この脆弱性が悪用されると、リモートのコードが実行される可能性があります。この攻撃は、ネットワーク接続経由で悪用される可能性があります。 (CVE-2019-15691 )

  - 1.10.1以前のTigerVNCバージョンは、ヒープバッファオーバーフローに対して脆弱です。値のチェックが不正確なためにCopyRectDecoderから脆弱性が発生する可能性があります。この脆弱性が悪用されると、リモートのコードが実行される可能性があります。この攻撃は、ネットワーク接続経由で悪用される可能性があります。
    (CVE-2019-15692)

  - 1.10.1以前のTigerVNCバージョンは、TightDecoder: : FilterGradientで発生するヒープバッファオーバーフローに対して脆弱です。この脆弱性が悪用されると、リモートのコードが実行される可能性があります。この攻撃は、ネットワーク接続経由で悪用される可能性があります。 (CVE-2019-15693 )

  - 1.10.1以前のTigerVNCバージョンは、DecodeManager: : decodeRectから発生する可能性のあるヒープバッファオーバーフローに対して脆弱です。MemOutStreamの処理におけるsigndnessのエラーにより脆弱性が発生します。
    この脆弱性が悪用されると、リモートのコードが実行される可能性があります。この攻撃は、ネットワーク接続経由で悪用される可能性があります。 (CVE-2019-15694 )

  - 1.10.1以前のTigerVNCバージョンは、CMsgReader: : readSetCursorから発生する可能性のあるスタックバッファオーバーフローに対して脆弱です。この脆弱性は、PixelFormatのサニタイズが不十分なために発生します。
    リモートの攻撃者がバッファの先頭からオフセットを選択して値の書き込みを開始できるため、この脆弱性が悪用されると、リモートでコードが実行される可能性があります。この攻撃は、ネットワーク接続経由で悪用される可能性があります。 (CVE-2019-15695 )

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

このtigervncの更新では、次の問題を修正します：

CVE-2019-15691：ZRLEDecoderでのスタックメモリの間違った使用によるuse-after-returnを修正しました（bsc#1159856）。

CVE-2019-15692：CopyRectDecode内のヒープベースのバッファオーバーフローを修正しました（bsc#1160250）。

CVE-2019-15693：TightDecoder：：FilterGradient内のヒープバッファオーバーフローを修正しました（bsc#1159858）。

CVE-2019-15694：MemOutStreamの処理での不適切なエラー処理によって引き起こされるヒープベースのバッファオーバーフローを修正しました（bsc#1160251）。

CVE-2019-15695：CMsgReader：：readSetCursorからトリガーされる可能性のあるスタックベースのバッファオーバーフローを修正しました（bsc#1159860）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

tigervnc に対するこの更新は、以下の修正を行います：

修正されたセキュリティ問題：

CVE-2019-15691：ZRLEDecoderでのスタックメモリの間違った使用によるuse-after-returnを修正しました（bsc#1159856）。

CVE-2019-15692：CopyRectDecode内のヒープベースのバッファオーバーフローを修正しました（bsc#1160250）。

CVE-2019-15693：TightDecoder：：FilterGradient内のヒープバッファオーバーフローを修正しました（bsc#1159858）。

CVE-2019-15694：MemOutStreamの処理での不適切なエラー処理によって引き起こされるヒープベースのバッファオーバーフローを修正しました（bsc#1160251）。

CVE-2019-15695：CMsgReader：：readSetCursorからトリガーされる可能性のあるスタックベースのバッファオーバーフローを修正しました（bsc#1159860）。

修正された非セキュリティ問題：

生成された証明書内のCNが64文字を超えないようにします。
（bnc#1041847）

現在のホスト名を短いまま使用してTLS証明書を生成するようにwith-vnc-key.shを変更します。（bsc#1041847）

ユーザー「vnc」下で動作する場合はMIT-SHM拡張機能を無効にします。（bsc#1053373）

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

This update for tigervnc fixes the following issues :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc provides the following fixes :

Security issues fixed :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Non-security issue fixed :

Make sure CN in generated certificate doesn't exceed 64 characters.
(bnc#1041847)

Change with-vnc-key.sh to generate TLS certificate using current hostname to keep it short. (bsc#1041847)

Disable MIT-SHM extension when running under user 'vnc'. (bsc#1053373)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tigervnc installed on the remote host is prior to 1.8.0-21.34. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1470 advisory.

  - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect     usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to     access stack variable, which has been already freed during the process of stack unwinding. Exploitation of     this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered     from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear to be exploitable via network connectivity.
    (CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via network connectivity. (CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially result into remote code execution. This attack appear     to be exploitable via network connectivity. (CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat.
    Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation     of this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3875 advisory.

  - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect     usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to     access stack variable, which has been already freed during the process of stack unwinding. Exploitation of     this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered     from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear to be exploitable via network connectivity.
    (CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via network connectivity. (CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially result into remote code execution. This attack appear     to be exploitable via network connectivity. (CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat.
    Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation     of this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - tigervnc: Stack use-after-return due to incorrect usage     of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from     CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in     TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in     DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in     CMsgReader::readSetCursor (CVE-2019-15695)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3875 advisory.

  - tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in CMsgReader::readSetCursor (CVE-2019-15695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
141215	Oracle Linux 7: tigervnc (ELSA-2020-3875 )	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/2/16	high
133201	SUSE SLES12セキュリティ更新プログラム：tigervnc（SUSE-SU-2020:0159-1）	Nessus	SuSE Local Security Checks	2020/1/23	2024/3/29	high
133395	SUSE SLES12セキュリティ更新プログラム：tigervnc（SUSE-SU-2020:0266-1）	Nessus	SuSE Local Security Checks	2020/1/31	2024/3/28	high
133201	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0159-1)	Nessus	SuSE Local Security Checks	2020/1/23	2024/3/29	high
133395	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0266-1)	Nessus	SuSE Local Security Checks	2020/1/31	2024/3/28	high
144989	Amazon Linux AMI : tigervnc (ALAS-2021-1470)	Nessus	Amazon Linux Local Security Checks	2021/1/14	2024/1/30	high
145143	EulerOS 2.0 SP3 : tigervnc (EulerOS-SA-2021-1127)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	high
139988	EulerOS 2.0 SP8 : tigervnc (EulerOS-SA-2020-1885)	Nessus	Huawei Local Security Checks	2020/8/28	2024/2/22	high
141215	Oracle Linux 7 : tigervnc (ELSA-2020-3875)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/2/16	high
141653	Scientific Linux Security Update : tigervnc on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
141028	RHEL 7 : tigervnc (RHSA-2020:3875)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/2/16	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high