A vulnerability has been discovered in UltraVNC, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due the "ClientConnection::NegotiateProtocolVersion()" function in vncviewer/ClientConnection.cpp using user-supplied length values to copy data without proper bounds checking. This can be exploited to cause a stack-based buffer overflow by e.g. sending specially crafted data to a vncviewer in "LISTENING" mode or by tricking a user into connecting to a malicious VNC server.

Successful exploitation allows execution of arbitrary code.

This may also be exploited if a DSM plugin is used, but requires that the attacker owns the encryption key used by vncviewer.

The vulnerability is confirmed in version 1.0.2 and reported in release candidates of version 1.0.4 prior to January 25th, 2008. Reportedly, UltraVNC server is not affected.

Solution
Apply updated version.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://forum.ultravnc.info/viewtopic.php?t=11850

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers