CVE-2009-0388 Integer overflow in n/a

What is CVE-2009-0388?

CVE-2009-0388 is a critical vulnerability in n/a, published on 4 Feb 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.

Weakness: CWE-189

Which versions are affected by CVE-2009-0388?

It affects 2 products.

Products include Tightvnc Tightvnc, Ultravnc Ultravnc.

How do I fix CVE-2009-0388?

No fix has been published for CVE-2009-0388 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-0388 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0388 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in n/a

• CVE-2021-42785 Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59 Critical 9.8
• CVE-2019-15678 Memory corruption in TightVNC Critical 9.8
• CVE-2019-15679 Memory corruption in TightVNC Critical 9.8
• CVE-2019-8287 Memory corruption in TightVNC Critical 9.8
• CVE-2023-27830 Privilege escalation in n/a Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j23w-r722-rm78.