CVE-2019-8274

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

Score

CVSS 3.1 9.8 Critical

Status

Modified - vulnerability@kaspersky.com

Published

2019-03-08

Last modified

2024-09-16

Weaknesses

CWE-122, CWE-787

Affected products

• Ultravnc (Kaspersky Lab)
• Sinumerik Access Mymachine/p2p (Siemens)
• Sinumerik Pcu Base Win10 Software/ipc (Siemens)
• Sinumerik Pcu Base Win7 Software/ipc (Siemens)
• Ultravnc (Uvnc)

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-021-ultravnc-heap-based-buffer-overflo…
• https://www.us-cert.gov/ics/advisories/icsa-20-161-06