NVD Vulnerability Detail

CVE-2019-8277

Summary	UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
Publication Date	March 9, 2019, 8:29 a.m.
Registration Date	Jan. 26, 2021, 11:44 a.m.
Last Update	Nov. 21, 2024, 1:49 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:uvnc:ultravnc::::::::					1.2.2.3

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:siemens:sinumerik_pcu_base_win7_software\/ipc::::::::		12.01
cpe:2.3:a:siemens:sinumerik_pcu_base_win10_software\/ipc::::::::				14.00
cpe:2.3:a:siemens:sinumerik_access_mymachine\/p2p::::::::				4.8

Related information, measures and tools

No	URL	タグ
1	https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
2	https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf	Third Party Advisory
3	https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
4	https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-024-ultravnc-improper-initialization/	Third Party Advisory
5	https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
6	https://www.us-cert.gov/ics/advisories/icsa-20-161-06	Third Party Advisory US Government Resource
7	https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
8	https://www.us-cert.gov/ics/advisories/icsa-20-161-06	Third Party Advisory US Government Resource
9	https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
10	https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-024-ultravnc-improper-initialization/	Third Party Advisory
11	https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
12	https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-665	不適切な初期化	https://cwe.mitre.org/data/definitions/665.html

JVN Vulnerability Information

UltraVNC におけるリソース管理に関する脆弱性

Title	UltraVNC におけるリソース管理に関する脆弱性
Summary	UltraVNC には、リソース管理に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	March 1, 2019, midnight
Registration Date	April 8, 2019, 12:09 p.m.
Last Update	April 8, 2019, 12:09 p.m.

Affected System

UVNC

Ultra VNC 1211

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-8277	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8277
National Vulnerability Database (NVD)
2	CVE-2019-8277	https://nvd.nist.gov/vuln/detail/CVE-2019-8277

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
UVNC
1	Top Page	https://www.uvnc.com/

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-20-161-06	https://www.us-cert.gov/ics/advisories/icsa-20-161-06
JVN
2	JVNVU#91051134	https://jvn.jp/vu/JVNVU91051134/index.html
3	JVNVU#97501786	https://jvn.jp/vu/JVNVU97501786/
関連文書
4	KLCERT-19-024: UltraVNC Improper Initialization	https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-024-ultravnc-improper-initialization/

Change Log

No	Changed Details	Date of change
3	[2020年06月11日] 参考情報：JVN (JVNVU#97501786) を追加	June 11, 2020, 4:17 p.m.
2	[2020年06月10日] 参考情報：ICS-CERT ADVISORY (ICSA-20-161-06) を追加	June 10, 2020, 2:28 p.m.
1	[2019年04月08日] 掲載	April 8, 2019, 12:09 p.m.
5	[2021年05月19日] 参考情報：JVN (JVNVU#91051134) を追加	May 19, 2021, 4:02 p.m.