VulnerabilityModified
CVE-2019-8276
UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS).
HIGH 7.5EPSS 5.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS). This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 5.72% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121, CWE-787
- Affected
- uvnc/ultravnc · siemens/sinumerik access mymachine\/p2p · siemens/sinumerik pcu base win10 software\/ipc · siemens/sinumerik pcu base win7 software\/ipc
- Source
- vulnerability@kaspersky.com
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdfThird Party Advisory
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-023-ultravnc-stack-based-buffer-overflow/Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06Third Party Advisory, US Government Resource
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdfThird Party Advisory
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-023-ultravnc-stack-based-buffer-overflow/Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.