Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.SUSE_SU-2020-2167-1.NASL
HistoryAug 10, 2020 - 12:00 a.m.

SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:2167-1)

2020-08-1000:00:00
This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
18
libvncserver
suse-su-2020:2167-1
information leak
buffer overflow
unaligned accesses
denial of service
tcp connection
null pointer dereference
integer overflows
out-of-bounds access
preauth buffer overwrite

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.019

Percentile

88.7%

JSON

This update for LibVNCServer fixes the following issues :

security update fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2020:2167-1.
# The text itself is copyright (C) SUSE.
#

include('compat.inc');

if (description)
{
  script_id(139453);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/26");

  script_cve_id(
    "CVE-2017-18922",
    "CVE-2018-21247",
    "CVE-2019-20839",
    "CVE-2019-20840",
    "CVE-2020-14397",
    "CVE-2020-14398",
    "CVE-2020-14399",
    "CVE-2020-14400",
    "CVE-2020-14401",
    "CVE-2020-14402",
    "CVE-2020-14403",
    "CVE-2020-14404"
  );

  script_name(english:"SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:2167-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"This update for LibVNCServer fixes the following issues :

security update fix CVE-2018-21247 [bsc#1173874], uninitialized memory
contents are vulnerable to Information leak fix CVE-2019-20839
[bsc#1173875], buffer overflow in ConnectClientToUnixSock() fix
CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode
can lead to denial of service fix CVE-2020-14398 [bsc#1173880],
improperly closed TCP connection causes an infinite loop in
libvncclient/sockets.c fix CVE-2020-14397 [bsc#1173700], NULL pointer
dereference in libvncserver/rfbregion.c fix CVE-2020-14399
[bsc#1173743], Byte-aligned data is accessed through uint32_t pointers
in libvncclient/rfbproto.c. fix CVE-2020-14400 [bsc#1173691],
Byte-aligned data is accessed through uint16_t pointers in
libvncserver/translate.c. fix CVE-2020-14401 [bsc#1173694], potential
integer overflows in libvncserver/scale.c fix CVE-2020-14402
[bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14403
[bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14404
[bsc#1173701], out-of-bounds access via encodings. fix CVE-2017-18922
[bsc#1173477], preauth buffer overwrite

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173477");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173691");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173694");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173700");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173701");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173743");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173874");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173875");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173876");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1173880");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2017-18922/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-21247/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-20839/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-20840/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14397/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14398/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14399/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14400/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14401/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14402/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14403/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14404/");
  # https://www.suse.com/support/update/announcement/2020/suse-su-20202167-1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?09a86114");
  script_set_attribute(attribute:"solution", value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud Crowbar 9 :

zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2020-2167=1

SUSE OpenStack Cloud Crowbar 8 :

zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-2167=1

SUSE OpenStack Cloud 9 :

zypper in -t patch SUSE-OpenStack-Cloud-9-2020-2167=1

SUSE OpenStack Cloud 8 :

zypper in -t patch SUSE-OpenStack-Cloud-8-2020-2167=1

SUSE OpenStack Cloud 7 :

zypper in -t patch SUSE-OpenStack-Cloud-7-2020-2167=1

SUSE Linux Enterprise Software Development Kit 12-SP5 :

zypper in -t patch SUSE-SLE-SDK-12-SP5-2020-2167=1

SUSE Linux Enterprise Server for SAP 12-SP4 :

zypper in -t patch SUSE-SLE-SAP-12-SP4-2020-2167=1

SUSE Linux Enterprise Server for SAP 12-SP3 :

zypper in -t patch SUSE-SLE-SAP-12-SP3-2020-2167=1

SUSE Linux Enterprise Server for SAP 12-SP2 :

zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-2167=1

SUSE Linux Enterprise Server 12-SP5 :

zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-2167=1

SUSE Linux Enterprise Server 12-SP4-LTSS :

zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2020-2167=1

SUSE Linux Enterprise Server 12-SP3-LTSS :

zypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-2167=1

SUSE Linux Enterprise Server 12-SP3-BCL :

zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-2167=1

SUSE Linux Enterprise Server 12-SP2-LTSS :

zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-2167=1

SUSE Linux Enterprise Server 12-SP2-BCL :

zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-2167=1

SUSE Enterprise Storage 5 :

zypper in -t patch SUSE-Storage-5-2020-2167=1

HPE Helion Openstack 8 :

zypper in -t patch HPE-Helion-OpenStack-8-2020-2167=1");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-18922");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/08/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:LibVNCServer-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libvncclient0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libvncclient0-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libvncserver0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libvncserver0-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(2|3|4|5)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2/3/4/5", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"4", reference:"LibVNCServer-debugsource-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libvncclient0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libvncclient0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libvncserver0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libvncserver0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"LibVNCServer-debugsource-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libvncclient0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libvncclient0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libvncserver0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libvncserver0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"LibVNCServer-debugsource-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libvncclient0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libvncclient0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libvncserver0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libvncserver0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"5", reference:"LibVNCServer-debugsource-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"5", reference:"libvncclient0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"5", reference:"libvncclient0-debuginfo-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"5", reference:"libvncserver0-0.9.9-17.31.1")) flag++;
if (rpm_check(release:"SLES12", sp:"5", reference:"libvncserver0-debuginfo-0.9.9-17.31.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "LibVNCServer");
}

References

Related

openvas 25
nessus 44
suse 5
mageia 2
virtuozzo 1
ubuntu 2
debian 2
osv 13
fedora 2
ics 1
ubuntucve 10
oraclelinux 3
rocky 1
almalinux 2
redhat 5
rosalinux 1
alpinelinux 10
cve 9
prion 10
veracode 9
redhatcve 9
nvd 11
cvelist 11
debiancve 10
centos 1
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:2167-1)
2021-04-19 00:00:00
openSUSE: Security Advisory for LibVNCServer (openSUSE-SU-2020:1025-1)
2020-07-22 00:00:00
openSUSE: Security Advisory for LibVNCServer (openSUSE-SU-2020:0988-1)
2020-07-19 00:00:00
nessus
nessus
openSUSE Security Update : LibVNCServer (openSUSE-2020-1056)
2020-07-27 00:00:00
openSUSE Security Update : LibVNCServer (openSUSE-2020-988)
2020-07-20 00:00:00
openSUSE Security Update : LibVNCServer (openSUSE-2020-1025)
2020-07-22 00:00:00
suse
suse
Security update for LibVNCServer (important)
2020-07-21 00:00:00
Security update for LibVNCServer (important)
2020-07-24 00:00:00
Security update for LibVNCServer (important)
2020-07-18 00:00:00
mageia
mageia
Updated libvncserver packages fix security vulnerability
2020-07-05 22:48:23
Updated vino packages fix security vulnerability
2020-07-10 11:01:08
virtuozzo
virtuozzo
Product update: Virtuozzo Hybrid Server 7.0 Update 14 Hotfix 2 (7.0.14-258)
2020-08-19 00:00:00
ubuntu
ubuntu
LibVNCServer vulnerabilities
2020-07-23 00:00:00
Vino vulnerabilities
2020-10-07 00:00:00
debian
debian
[SECURITY] [DLA 2264-1] libvncserver security update
2020-06-30 09:29:43
[SECURITY] [DLA 2347-1] libvncserver security update
2020-08-28 21:36:49
osv
osv
libvncserver - security update
2020-08-28 00:00:00
libvncserver - security update
2020-06-30 00:00:00
vino vulnerabilities
2020-10-07 12:45:39
fedora
fedora
[SECURITY] Fedora 32 Update: libvncserver-0.9.13-2.fc32
2020-07-16 01:14:52
[SECURITY] Fedora 31 Update: libvncserver-0.9.13-2.fc31
2020-07-15 01:12:04
ics
ics
Siemens SIMATIC ITC
2021-12-16 12:00:00
ubuntucve
ubuntucve
CVE-2020-14403
2020-06-17 00:00:00
CVE-2020-14404
2020-06-17 00:00:00
CVE-2020-14401
2020-06-17 00:00:00
oraclelinux
oraclelinux
libvncserver security update
2021-05-25 00:00:00
libvncserver security update
2020-08-04 00:00:00
libvncserver security update
2020-08-10 00:00:00
rocky
rocky
libvncserver security update
2021-05-18 06:09:01
almalinux
almalinux
Moderate: libvncserver security update
2021-05-18 06:09:01
Important: libvncserver security update
2020-08-10 13:51:34
redhat
redhat
(RHSA-2021:1811) Moderate: libvncserver security update
2021-05-18 06:09:01
(RHSA-2020:3385) Important: libvncserver security update
2020-08-10 13:51:34
(RHSA-2020:3456) Important: libvncserver security update
2020-08-17 12:54:38
rosalinux
rosalinux
Advisory ROSA-SA-2021-1900
2021-07-02 17:22:34
alpinelinux
alpinelinux
CVE-2020-14399
2020-06-17 16:15:11
CVE-2018-21247
2020-06-17 16:15:00
CVE-2019-20840
2020-06-17 16:15:11
cve
cve
CVE-2020-14401
2020-06-17 16:15:12
CVE-2018-21247
2020-06-17 16:15:11
CVE-2019-20840
2020-06-17 16:15:11
prion
prion
Code injection
2020-06-17 16:15:00
Information disclosure
2020-06-17 16:15:00
Code injection
2020-06-17 16:15:00
veracode
veracode
Denial Of Service (DoS)
2020-06-18 04:59:57
Denial Of Service (DoS)
2020-06-18 03:02:53
Information Disclosure
2020-06-24 08:05:17
redhatcve
redhatcve
CVE-2020-14398
2020-07-24 11:07:45
CVE-2018-21247
2020-06-23 06:55:21
CVE-2020-14399
2020-07-24 11:37:43
nvd
nvd
CVE-2020-14398
2020-06-17 16:15:11
CVE-2018-21247
2020-06-17 16:15:11
CVE-2020-14397
2020-06-17 16:15:11
cvelist
cvelist
CVE-2018-21247
2020-06-17 15:10:51
CVE-2020-14398
2020-06-17 15:13:21
CVE-2019-20840
2020-06-17 15:11:10
debiancve
debiancve
CVE-2018-21247
2020-06-17 16:15:11
CVE-2019-20840
2020-06-17 16:15:11
CVE-2020-14401
2020-06-17 16:15:12
centos
centos
libvncserver security update
2020-08-07 12:28:23

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.019

Percentile

88.7%

JSON
Related for SUSE_SU-2020-2167-1.NASL
openvas25nessus44suse5mageia2virtuozzo1ubuntu2debian2osv13fedora2ics1ubuntucve10oraclelinux3rocky1almalinux2redhat5rosalinux1alpinelinux10cve9prion10veracode9redhatcve9nvd11cvelist11debiancve10centos1