CVE-2019-15681

Vulnerability

CVE-2019-15681 is a memory leak (CWE-655) in the VNC server code of LibVNCServer, specifically in the handling of ServerCutText messages. The vulnerability exists in versions prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. When a ServerCutText message is sent, the server fails to properly free allocated memory, leading to a leak that can expose stack memory contents. This issue affects LibVNCServer and downstream products such as iTALC and Vino [2][3][4].

Exploitation

An attacker with network connectivity to a vulnerable VNC server can trigger the memory leak by sending a crafted ServerCutText message. No authentication is required, as the vulnerability is reachable during the initial handshake or normal operation. The attacker can repeatedly trigger the leak to accumulate leaked stack data, which may include sensitive information such as memory addresses. Combined with another vulnerability, this information can be used to bypass ASLR [2][4].

Impact

Successful exploitation results in information disclosure of stack memory contents. The attacker gains the ability to read potentially sensitive data, such as memory addresses, which can be leveraged to defeat address space layout randomization (ASLR). This does not directly provide code execution but can be a stepping stone for further attacks [2][3][4].

Mitigation

The vulnerability is fixed in LibVNCServer commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. Ubuntu has released updated packages for LibVNCServer (USN-4407-1), iTALC (USN-4547-1), and Vino (USN-4573-1) that include the fix [2][3][4]. Users should update to the latest versions of these packages. No workaround is available if the patch cannot be applied.