TightVNC Viewer flaw allows pre-authentication code execution on Windows, PoC published
VULNERABILITYredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A pre-authentication remote code execution flaw in TightVNC Viewer, demonstrated against 2.8.88 x64, lets a malicious VNC server corrupt the viewer's memory via an integer overflow in screen size handling. Exploitation requires either network access to a viewer in Listening Mode (TCP 5500, no password or IP restriction) or a user connecting to an attacker-controlled server. Researchers credited to SeongJoon Cho of SSD Labs Korea have released a PoC, and the vendor says versions 2.8.89 and 2.8.90 address viewer issues, with 2.8.90 recommended for that branch.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update TightVNC Viewer to version 2.8.90, the recommended version for that branch, or at least 2.8.89.
- Turn off Listening Mode in the viewer when it is not needed.
- Restrict access to TCP port 5500 to trusted systems only.
- Avoid connecting the viewer to untrusted VNC servers.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News