KLA10428 LPE vulnerability in UltraVNC

An untrusted path vulnerability was found in UltraVNC. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally via a DLL hijack.

Original advisories

Related products

UltraVNC

CVE list

CVE-2010-5248 high

Solution

Update to latest version

UltraVNC

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• UltraVNC version 1.0.8.2; Previous versions also can be affected