{"id":53107,"date":"2019-11-24T00:00:00","date_gmt":"2019-11-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc"},"modified":"2020-02-18T14:00:58","modified_gmt":"2020-02-18T11:00:58","slug":"37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","title":{"rendered":"37 vulnerabilit\u00e0 in diverse implementazioni di VNC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pavel Cheremushkin del Laboratorio Kaspersky ha analizzato<\/a><\/noindex> diverse implementazioni del sistema di accesso remoto VNC (Virtual Network Computing) e ha identificato 37 vulnerabilit\u00e0, causate da problemi nella gestione della memoria. Le vulnerabilit\u00e0 scoperte nelle implementazioni dei server VNC possono essere sfruttate solo da utenti autenticati, mentre gli attacchi alle vulnerabilit\u00e0 nel codice client sono possibili quando un utente si collega a un server controllato da un malintenzionato.<\/p>\n

Il numero maggiore di vulnerabilit\u00e0 \u00e8 stato trovato nel pacchetto UltraVNC<\/a><\/noindex>, disponibile solo per la piattaforma Windows. Complessivamente, in UltraVNC sono state identificate 22 vulnerabilit\u00e0. 13 di queste vulnerabilit\u00e0 possono potenzialmente portare all'esecuzione di codice nel sistema, 5 a perdite di contenuto delle aree di memoria e 4 a interruzioni nel servizio.
\nLe vulnerabilit\u00e0 sono state corrette nella versione 1.2.3.0<\/a><\/noindex>.<\/p>\n

Nel pacchetto open source LibVNC<\/a><\/noindex> (LibVNCServer e LibVNCClient), che viene utilizzato<\/a><\/noindex> in VirtualBox, sono state trovate 10 vulnerabilit\u00e0.
\n5 vulnerabilit\u00e0 (CVE-2018-20020<\/a><\/noindex>, CVE-2018-20019<\/a><\/noindex>, CVE-2018-15127<\/a><\/noindex>, CVE-2018-15126<\/a><\/noindex>, CVE-2018-6307<\/a><\/noindex>) sono causate da overflow del buffer e possono potenzialmente portare all'esecuzione di codice. 3 vulnerabilit\u00e0 possono determinare la perdita di informazioni, 2 portare a interruzioni nel servizio.
\nTutti i problemi sono gi\u00e0 stati risolti dagli sviluppatori, ma le modifiche sono state riflettute<\/a><\/noindex> solo nel branch master.<\/p>\n

In TightVNC<\/a><\/noindex> (\u00e8 stato testato un branch cross-platform obsoleto 1.3<\/a><\/noindex>, in quanto l'attuale versione 2.x \u00e8 rilasciata solo per Windows), sono state trovate 4 vulnerabilit\u00e0. Tre problemi (CVE-2019-15679<\/a><\/noindex>, CVE-2019-15678<\/a><\/noindex>, CVE-2019-8287<\/a><\/noindex>) sono causati da overflow del buffer nelle funzioni InitialiseRFBConnection, rfbServerCutText e HandleCoRREBBP, e possono potenzialmente portare all'esecuzione di codice. Un problema (CVE-2019-15680<\/a><\/noindex>) provoca un'interruzione nel servizio. Anche se gli sviluppatori di TightVNC sono stati informati<\/a><\/noindex> dei problemi gi\u00e0 lo scorso anno, le vulnerabilit\u00e0 rimangono ancora non corrette.<\/p>\n

Nel pacchetto cross-platform TurboVNC<\/a><\/noindex> (fork di TightVNC 1.3, che utilizza la libreria libjpeg-turbo), \u00e8 stata trovata solo una vulnerabilit\u00e0 (CVE-2019-15683<\/a><\/noindex>), ma \u00e8 considerata pericolosa e, in presenza di accesso autenticato al server, consente di eseguire codice proprio, poich\u00e9 in caso di overflow del buffer \u00e8 possibile controllare l'indirizzo di ritorno. Il problema \u00e8 stato risolto il 23 agosto<\/a><\/noindex> e non si manifesta nell'attuale versione 2.2.3<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 VNC (Virtual Network Computing) \u0438 \u0432\u044b\u044f\u0432\u0438\u043b 37 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53107","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4737 vulnerabilit\u00e0 in diverse implementazioni VNC | ProHoster","description":"Pavel Cheremushkin del Laboratorio Kaspersky ha analizzato diverse implementazioni del sistema.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4737 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC | ProHoster","og:description":"\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53107","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:07:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:31:28","updated":"2026-01-24 06:07:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/53107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=53107"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/53107\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=53107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=53107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=53107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}