CVE-2018-6307

Vulnerability

A heap use-after-free vulnerability exists in the server code of the file transfer extension in LibVNC (LibVNCServer) before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b and prior to version 0.9.12. The flaw occurs when handling file transfer requests, where a freed heap object is accessed, leading to memory corruption [1].

Exploitation

An attacker with network access to a VNC server running a vulnerable version can send specially crafted file transfer extension messages. By manipulating the sequence of file transfer operations, the attacker can trigger a use-after-free condition, potentially achieving code execution [1]. No authentication is required if the VNC server allows file transfer without credentials.

Impact

Successful exploitation results in remote code execution on the VNC server, typically with the privileges of the VNC server process. This can lead to full compromise of the affected system, including data theft, installation of malware, or further lateral movement [1].

Mitigation

The vulnerability is fixed in LibVNCServer version 0.9.12 and the corresponding commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b. Users should upgrade to the latest version. No workarounds are available; disabling the file transfer extension may reduce risk but is not a complete mitigation [1].