37 qhov tsis zoo hauv ntau qhov kev siv VNC

Pavel Cheremushkin los ntawm Kaspersky Lab soj ntsuam ntau yam kev siv ntawm VNC (Virtual Network Computing) tej thaj chaw deb nkag tau thiab txheeb xyuas 37 qhov tsis zoo los ntawm cov teeb meem thaum ua haujlwm nrog kev nco. Vulnerabilities pom nyob rau hauv VNC server kev siv tsuas yog siv tau los ntawm tus neeg siv qhov tseeb, thiab kev tawm tsam ntawm qhov tsis zoo hauv tus neeg siv code tuaj yeem ua tau thaum tus neeg siv txuas rau lub server tswj los ntawm tus neeg tawm tsam.

Qhov loj tshaj plaws ntawm cov vulnerabilities pom nyob rau hauv pob UltraVNC, tsuas yog muaj rau Windows platform. Tag nrho ntawm 22 qhov tsis zoo tau raug txheeb xyuas hauv UltraVNC. 13 qhov tsis zoo tuaj yeem ua rau muaj kev ua txhaum cai ntawm lub kaw lus, 5 mus rau lub cim xeeb xau, thiab 4 rau kev tsis lees paub kev pabcuam.
Vulnerabilities tsau nyob rau hauv kev tso tawm 1.2.3.0.

Hauv lub tsev qiv ntawv qhib LibVNC (LibVNCServer and LibVNCClient), uas yog siv Hauv VirtualBox, 10 qhov tsis zoo tau raug txheeb xyuas.
5 vulnerabilities (CVE-2018-20020, CVE-2018-20019, CVE-2018-15127, CVE-2018-15126, CVE-2018-6307) yog tshwm sim los ntawm qhov tsis txaus thiab tuaj yeem ua rau kev ua txhaum cai. 3 qhov tsis zoo tuaj yeem ua rau cov ntaub ntawv xau, 2 rau kev tsis lees paub kev pabcuam.
Tag nrho cov teeb meem twb tau kho los ntawm cov neeg tsim khoom, tab sis cov kev hloov pauv tseem muaj xav txog tsuas yog nyob rau hauv tus tswv ceg.

В TightVNC (kuaj hla-platform legacy ceg 1.3, txij li tam sim no version 2.x tso tawm tsuas yog rau Windows), 4 qhov tsis zoo tau pom. Peb qhov teeb meem (CVE-2019-15679, CVE-2019-15678, CVE-2019-8287) yog tshwm sim los ntawm kev tsis txaus nyob rau hauv InitialiseRFBConnection, rfbServerCutText, thiab HandleCoRRBBP kev ua haujlwm, thiab tuaj yeem ua rau muaj kev ua txhaum cai. Ib qhov teeb meem (CVE-2019-15680) ua rau muaj kev tsis lees paub kev pabcuam. Txawm tias TightVNC developers yog ceeb toom hais txog cov teeb meem xyoo tas los, cov kev tsis txaus ntseeg tseem tsis raug kho.

Nyob rau hauv ib tug ntoo khaub lig-platform pob TurboVNC (ib rab diav rawg ntawm TightVNC 1.3 uas siv lub tsev qiv ntawv libjpeg-turbo), tsuas yog pom muaj qhov tsis zoo (CVE-2019-15683), tab sis nws yog qhov txaus ntshai thiab, yog tias koj muaj kev lees paub nkag mus rau lub server, nws ua rau nws muaj peev xwm los teeb tsa kev ua tiav ntawm koj cov cai, vim tias yog qhov tsis txaus, nws muaj peev xwm tswj tau qhov chaw nyob xa rov qab. Qhov teeb meem daws tau 23 Aug thiab tsis tshwm sim hauv qhov kev tso tawm tam sim no 2.2.3.

Tau qhov twg los: opennet.ru