CVE-2020-14404

Vulnerability

The vulnerability resides in libvncserver/rre.c of LibVNCServer versions prior to 0.9.13. It allows out-of-bounds access when processing certain encodings, specifically related to the RRE (Raw Rectangles Encoding) handler. An attacker can trigger this by sending crafted RRE-encoded framebuffer update requests to the server. [1]

Exploitation

An attacker with network access to a VNC server using LibVNCServer (such as Vino) can send a malicious RRE-encoded message. No authentication is required if the server is configured to allow unauthenticated connections. The out-of-bounds access occurs during parsing of the encoding data, potentially leading to memory corruption. [1]

Impact

Successful exploitation could allow the attacker to cause a denial of service (crash) or possibly execute arbitrary code on the server. The impact is limited to the VNC server process; however, if the server runs with elevated privileges, code execution could lead to full system compromise. [1]

Mitigation

The vulnerability is fixed in LibVNCServer version 0.9.13. For Vino (GNOME's VNC server), the fix is included in the Ubuntu security update USN-4573-1, published on 7 October 2020. Users should update to the latest version of their distribution's LibVNCServer package or apply the vendor patch. No workaround is available. [1]