CVE-2019-8269 Memory corruption in UltraVNC
A stack-based buffer overflow in UltraVNC's FileTransfer module allows remote attackers to cause a denial of service via network connectivity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-8269?
CVE-2019-8269 is a high-severity memory corruption vulnerability in Kaspersky Lab UltraVNC, published on 9 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileTransfer module, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1207.
Which versions are affected by CVE-2019-8269?
It affects 4 products.
Products include Siemens Sinumerik Access Mymachine\/P2p, Siemens Sinumerik Pcu Base Win10 Software\/Ipc, Siemens Sinumerik Pcu Base Win7 Software\/Ipc, Uvnc Ultravnc.
How do I fix CVE-2019-8269?
No fix has been published for CVE-2019-8269 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-8269 being exploited?
There is no known exploitation of CVE-2019-8269 in the wild and no public exploit code.
Other vulnerabilities in Kaspersky Lab UltraVNC
Sources
Also known as GHSA-c3jw-vhq9-x9j2.