Apache Guacamole: Integer overflow in handling of VNC image buffers

Vulnerability

Apache Guacamole versions 1.5.3 and older contain an integer overflow vulnerability in the handling of VNC image buffers. When a user connects to a VNC server, specially crafted data from a malicious or compromised VNC server can cause the integer overflow, leading to memory corruption [1]. The issue resides in the guacd process, which processes the VNC protocol data.

Exploitation

An attacker must control or compromise a VNC server that a Guacamole user connects to. The attacker then sends specially crafted VNC image data that triggers an integer overflow during buffer size calculations. No special authentication is required beyond normal VNC connection credentials. The attacker's position is network-level, as they must be able to send crafted VNC data to the victim's Guacamole client.

Impact

Successful exploitation could allow the attacker to achieve arbitrary code execution with the privileges of the guacd process. This could lead to full compromise of the Guacamole gateway, including disclosure of sensitive data, modification or destruction of resources, and potential lateral movement within the network [1].

Mitigation

Users should upgrade to Apache Guacamole version 1.5.4 or later, which contains a fix for this issue [1]. No workarounds have been published. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.