CVE-2018-7225

Vulnerability

An issue exists in LibVNCServer versions through 0.9.11 in the function rfbProcessClientNormalMessage() in rfbserver.c. When handling a rfbClientCutText message, the server does not sanitize the msg.cct.length field before using it. This can lead to accessing uninitialized or potentially sensitive data, or to integer overflow conditions. The problem was identified in version 0.9.9 (used in Red Hat Enterprise Linux 7) and persists to the latest commit in the repository at the time of reporting [1][4].

Exploitation

An attacker with network access to a VNC server can send specially crafted VNC packets containing a rfbClientCutText message with a malicious length value. No authentication is required if the server is configured to allow unauthenticated connections. The attacker can repeatedly send such packets to trigger the vulnerability [1][4].

Impact

Successful exploitation may result in the disclosure of sensitive information from uninitialized memory areas, or cause integer overflows leading to unspecified impacts. The attacker could potentially crash the server or execute arbitrary code, although the primary risk highlighted in advisories is information disclosure. Red Hat rates this as a Moderate severity issue [1][4].

Mitigation

Red Hat released an update via RHSA-2018:1055 for Red Hat Enterprise Linux 7 on 2018-04-10, which includes patches for this vulnerability. Users should update to the fixed libvncserver package. Ubuntu also addressed the issue in iTALC (which vendors LibVNCServer) in USN-4587-1 and USN-4547-1 [2][3]. General users should update to the latest version of LibVNCServer; if not possible, restrict network access to VNC services to trusted hosts.