CVE-2018-7225

An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.

Weakness

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Affected Software

Name	Vendor	Start Version	End Version
Libvncserver	Libvncserver_project	*	0.9.11 (including)
Red Hat Enterprise Linux 7	RedHat	libvncserver-0:0.9.9-12.el7_5	*
Italc	Ubuntu	bionic	*
Italc	Ubuntu	trusty	*
Italc	Ubuntu	upstream	*
Italc	Ubuntu	xenial	*
Libvncserver	Ubuntu	artful	*
Libvncserver	Ubuntu	bionic	*
Libvncserver	Ubuntu	devel	*
Libvncserver	Ubuntu	focal	*
Libvncserver	Ubuntu	groovy	*
Libvncserver	Ubuntu	hirsute	*
Libvncserver	Ubuntu	impish	*
Libvncserver	Ubuntu	jammy	*
Libvncserver	Ubuntu	kinetic	*
Libvncserver	Ubuntu	lunar	*
Libvncserver	Ubuntu	mantic	*
Libvncserver	Ubuntu	noble	*
Libvncserver	Ubuntu	oracular	*
Libvncserver	Ubuntu	trusty	*
Libvncserver	Ubuntu	xenial	*
Tightvnc	Ubuntu	bionic	*
Tightvnc	Ubuntu	groovy	*
Tightvnc	Ubuntu	hirsute	*
Tightvnc	Ubuntu	impish	*
Tightvnc	Ubuntu	kinetic	*
Tightvnc	Ubuntu	lunar	*
Tightvnc	Ubuntu	mantic	*
Tightvnc	Ubuntu	trusty	*
Tightvnc	Ubuntu	trusty/esm	*
Tightvnc	Ubuntu	upstream	*
Tightvnc	Ubuntu	xenial	*
Vino	Ubuntu	bionic	*
Vino	Ubuntu	devel	*
Vino	Ubuntu	focal	*
Vino	Ubuntu	groovy	*
Vino	Ubuntu	hirsute	*
Vino	Ubuntu	impish	*
Vino	Ubuntu	jammy	*
Vino	Ubuntu	kinetic	*
Vino	Ubuntu	lunar	*
Vino	Ubuntu	mantic	*
Vino	Ubuntu	noble	*
Vino	Ubuntu	oracular	*
Vino	Ubuntu	trusty	*
Vino	Ubuntu	xenial	*

Potential Mitigations

Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Understand the programming language’s underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, “not-a-number” calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.

https://cwe.mitre.org/data/definitions/92.html

NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-7225
CWE	https://cwe.mitre.org/data/definitions/190.html

Integer Overflow or Wraparound

Weakness

Affected Software

Potential Mitigations

References

CVE-2018-7225

Integer Overflow or Wraparound

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References