realvnc vnc_viewer 输入验证不恰当

CVE编号

CVE-2021-41380

利用情况

暂无

补丁情况

N/A

披露时间

2021-09-18

漏洞描述

** DISPUTED ** RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang, until terminated, but no memory leak occurs - the resources are freed once the hung process is terminated and the resource usage is constant during the hang. Only the process that is connected to the fake Server is affected. This is an application bug, not a security issue.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	realvnc	vnc_viewer	6.21.406	-

CVSS3评分 6.5

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 未更改
• 用户交互 需要
• 可用性 高
• 保密性 无
• 完整性 无

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-ID 漏洞类型 CWE-20 输入验证不恰当