{"id":53107,"date":"2019-11-24T00:00:00","date_gmt":"2019-11-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc"},"modified":"2020-02-18T14:00:58","modified_gmt":"2020-02-18T11:00:58","slug":"37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","title":{"rendered":"37 vulnerabilidades em v\u00e1rias implementa\u00e7\u00f5es do VNC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pavel Cheremushkin do Laborat\u00f3rio Kaspersky analisou<\/a><\/noindex> diferentes implementa\u00e7\u00f5es do sistema de acesso remoto VNC (Virtual Network Computing) e identificou 37 vulnerabilidades causadas por problemas de gerenciamento de mem\u00f3ria. As vulnerabilidades identificadas nas implementa\u00e7\u00f5es dos servidores VNC podem ser exploradas apenas por usu\u00e1rios autenticados, enquanto ataques \u00e0s vulnerabilidades no c\u00f3digo do cliente podem ocorrer quando um usu\u00e1rio se conecta a um servidor controlado por um invasor.<\/p>\n

O maior n\u00famero de vulnerabilidades foi encontrado no pacote UltraVNC<\/a><\/noindex>, dispon\u00edvel apenas para a plataforma Windows. No total, foram identificadas 22 vulnerabilidades no UltraVNC. 13 vulnerabilidades podem potencialmente levar \u00e0 execu\u00e7\u00e3o de c\u00f3digo no sistema, 5 ao vazamento de informa\u00e7\u00f5es de \u00e1reas de mem\u00f3ria e 4 a nega\u00e7\u00e3o de servi\u00e7o.
\nAs vulnerabilidades foram corrigidas na vers\u00e3o 1.2.3.0<\/a><\/noindex>.<\/p>\n

Na biblioteca p\u00fablica LibVNC<\/a><\/noindex> (LibVNCServer e LibVNCClient), que \u00e9 utilizado<\/a><\/noindex> est\u00e1 no VirtualBox, foram encontradas 10 vulnerabilidades.
\n5 vulnerabilidades (CVE-2018-20020<\/a><\/noindex>, CVE-2018-20019<\/a><\/noindex>, CVE-2018-15127<\/a><\/noindex>, CVE-2018-15126<\/a><\/noindex>, CVE-2018-6307<\/a><\/noindex>) s\u00e3o causadas por estouro de buffer e podem potencialmente levar \u00e0 execu\u00e7\u00e3o de c\u00f3digo. 3 vulnerabilidades podem levar ao vazamento de informa\u00e7\u00f5es e 2 \u00e0 nega\u00e7\u00e3o de servi\u00e7o.
\nTodos os problemas j\u00e1 foram resolvidos pelos desenvolvedores, mas as altera\u00e7\u00f5es ainda n\u00e3o est\u00e3o refletidas<\/a><\/noindex> apenas na ramifica\u00e7\u00e3o master.<\/p>\n

Em TightVNC<\/a><\/noindex> (uma ramifica\u00e7\u00e3o desatualizada foi testada, 1.3<\/a><\/noindex>j\u00e1 que a vers\u00e3o atual 2.x \u00e9 lan\u00e7ada apenas para Windows), foram encontradas 4 vulnerabilidades. Tr\u00eas problemas (CVE-2019-15679<\/a><\/noindex>, CVE-2019-15678<\/a><\/noindex>, CVE-2019-8287<\/a><\/noindex>) foram causados por estouro de buffer nas fun\u00e7\u00f5es InitialiseRFBConnection, rfbServerCutText e HandleCoRREBBP e potencialmente podem levar \u00e0 execu\u00e7\u00e3o de c\u00f3digo. Um problema (CVE-2019-15680<\/a><\/noindex>) leva \u00e0 nega\u00e7\u00e3o de servi\u00e7o. Embora os desenvolvedores do TightVNC tenham sido notificados<\/a><\/noindex> avisados sobre os problemas no ano passado, as vulnerabilidades permanecem n\u00e3o corrigidas.<\/p>\n

No pacote multiplataforma TurboVNC<\/a><\/noindex> (um fork do TightVNC 1.3, que usa a biblioteca libjpeg-turbo), foi encontrada apenas uma vulnerabilidade (CVE-2019-15683<\/a><\/noindex>), mas ela \u00e9 cr\u00edtica e, com acesso autenticado ao servidor, permite a execu\u00e7\u00e3o de c\u00f3digo, pois, durante o estouro de buffer, \u00e9 poss\u00edvel controlar o endere\u00e7o de retorno. O problema foi resolvido em 23 de agosto<\/a><\/noindex> e n\u00e3o se apresenta na vers\u00e3o atual 2.2.3<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 VNC (Virtual Network Computing) \u0438 \u0432\u044b\u044f\u0432\u0438\u043b 37 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53107","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4737 vulnerabilidades em v\u00e1rias implementa\u00e7\u00f5es do VNC | ProHoster","description":"Pavel Cheremushkin do Laborat\u00f3rio Kaspersky analisou diferentes implementa\u00e7\u00f5es do sistema.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4737 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 VNC | ProHoster","og:description":"\u041f\u0430\u0432\u0435\u043b \u0427\u0435\u0440\u0435\u043c\u0443\u0448\u043a\u0438\u043d \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/37-uyazvimostej-v-razlichnyh-realizatsiyah-vnc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53107","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:07:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:31:28","updated":"2026-01-24 06:07:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=53107"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53107\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=53107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=53107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=53107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}