CVE-2006-1652

UltraVNC <1.0.1 - Buffer Overflow

Title source: llm

Description

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.

Exploits (6)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16490
exploitdb WORKING POC VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1643
exploitdb WORKING POC VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1642
exploitdb WRITEUP VERIFIED
by Luigi Auriemma · textremotewindows
https://www.exploit-db.com/exploits/27569
exploitdb WORKING POC VERIFIED
by Luigi Auriemma · pythonremotewindows
https://www.exploit-db.com/exploits/27568
metasploit WORKING POC NORMAL
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/vnc/ultravnc_client.rb

Scores

EPSS 0.8594
EPSS Percentile 99.4%

Details

CWE
CWE-119
Status published
Products (2)
ultravnc/tabbed_viewer 1.29
ultravnc/vnc_viewer 1.0.1
Published Apr 06, 2006
Tracked Since Feb 18, 2026