{"id":53107,"date":"2019-11-24T00:00:00","date_gmt":"2019-11-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc"},"modified":"2020-02-18T14:00:58","modified_gmt":"2020-02-18T11:00:58","slug":"37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","title":{"rendered":"37 vuln\u00e9rabilit\u00e9s dans diverses impl\u00e9mentations de VNC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pavel Cheremushkin du Laboratoire Kaspersky a analys\u00e9<\/a><\/noindex> diverses r\u00e9alisations du syst\u00e8me d'acc\u00e8s \u00e0 distance VNC (Virtual Network Computing) et a identifi\u00e9 37 vuln\u00e9rabilit\u00e9s, caus\u00e9es par des probl\u00e8mes de gestion de la m\u00e9moire. Les vuln\u00e9rabilit\u00e9s d\u00e9tect\u00e9es dans les implementations des serveurs VNC ne peuvent \u00eatre exploit\u00e9es que par un utilisateur authentifi\u00e9, et les attaques sur les vuln\u00e9rabilit\u00e9s du code client peuvent survenir lors de la connexion d'un utilisateur \u00e0 un serveur contr\u00f4l\u00e9 par un attaquant.<\/p>\n

Le plus grand nombre de vuln\u00e9rabilit\u00e9s a \u00e9t\u00e9 trouv\u00e9 dans le paquet UltraVNC<\/a><\/noindex>, disponible uniquement pour la plateforme Windows. Un total de 22 vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans UltraVNC. 13 vuln\u00e9rabilit\u00e9s pourraient potentiellement conduire \u00e0 l'ex\u00e9cution de code dans le syst\u00e8me, 5 \u00e0 la fuite de contenu des zones m\u00e9moires et 4 \u00e0 un d\u00e9ni de service.
\nLes vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans la version 1.2.3.0<\/a><\/noindex>.<\/p>\n

Dans la biblioth\u00e8que open source LibVNC<\/a><\/noindex> (LibVNCServer et LibVNCClient), qui on utilise<\/a><\/noindex> dans VirtualBox, a r\u00e9v\u00e9l\u00e9 10 vuln\u00e9rabilit\u00e9s.
\n5 vuln\u00e9rabilit\u00e9s (CVE-2018-20020<\/a><\/noindex>, CVE-2018-20019<\/a><\/noindex>, CVE-2018-15127<\/a><\/noindex>, CVE-2018-15126<\/a><\/noindex>, CVE-2018-6307<\/a><\/noindex>) proviennent d'un d\u00e9passement de tampon et pourraient potentiellement conduire \u00e0 une ex\u00e9cution de code. 3 vuln\u00e9rabilit\u00e9s peuvent entra\u00eener une fuite d'informations, 2 \u00e0 un d\u00e9ni de service.
\nTous les probl\u00e8mes ont d\u00e9j\u00e0 \u00e9t\u00e9 corrig\u00e9s par les d\u00e9veloppeurs, mais les changements sont pour l\u2019instant r\u00e9fl\u00e9t\u00e9s<\/a><\/noindex> uniquement dans la branche master.<\/p>\n

Dans TightVNC<\/a><\/noindex> (une branche obsol\u00e8te multiplateforme a \u00e9t\u00e9 test\u00e9e, 1.3<\/a><\/noindex>car la version actuelle 2.x est publi\u00e9e uniquement pour Windows), a r\u00e9v\u00e9l\u00e9 4 vuln\u00e9rabilit\u00e9s. Trois probl\u00e8mes (CVE-2019-15679<\/a><\/noindex>, CVE-2019-15678<\/a><\/noindex>, CVE-2019-8287<\/a><\/noindex>) proviennent d'un d\u00e9passement de tampon dans les fonctions InitialiseRFBConnection, rfbServerCutText et HandleCoRREBBP, et pourraient potentiellement conduire \u00e0 une ex\u00e9cution de code. Un probl\u00e8me (CVE-2019-15680<\/a><\/noindex>) entra\u00eene un d\u00e9ni de service. Bien que les d\u00e9veloppeurs de TightVNC aient \u00e9t\u00e9 inform\u00e9s<\/a><\/noindex> des probl\u00e8mes l'ann\u00e9e derni\u00e8re, les vuln\u00e9rabilit\u00e9s restent non corrig\u00e9es.<\/p>\n

Dans le paquet multiplateforme TurboVNC<\/a><\/noindex> (un fork de TightVNC 1.3 utilisant la biblioth\u00e8que libjpeg-turbo), une seule vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 trouv\u00e9e (CVE-2019-15683<\/a><\/noindex>), mais elle est dangereuse et avec un acc\u00e8s authentifi\u00e9 au serveur, permet d'ex\u00e9cuter son propre code, car lors d'un d\u00e9passement de tampon, il est possible de contr\u00f4ler l'adresse de retour. Le probl\u00e8me a \u00e9t\u00e9 corrig\u00e9 le 23 ao\u00fbt<\/a><\/noindex> et ne se manifeste pas dans la version actuelle 2.2.3<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 VNC (Virtual Network Computing) \u0438 \u0432\u044b\u044f\u0432\u0438\u043b 37 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53107","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4737 vuln\u00e9rabilit\u00e9s dans diverses impl\u00e9mentations de VNC | ProHoster","description":"Pavel Cheremushkin du Laboratoire Kaspersky a analys\u00e9 diverses r\u00e9alisations du syst\u00e8me.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4737 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC | ProHoster","og:description":"\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53107","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:07:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:31:28","updated":"2026-01-24 06:07:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=53107"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53107\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=53107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=53107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=53107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}