CVE-2006-1652

UltraVNC <1.0.1 - Buffer Overflow

Title source: llm

Description

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.

Exploits (6)

exploitdb WORKING POC VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1643
exploitdb WORKING POC VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1642
exploitdb WORKING POC VERIFIED
by Luigi Auriemma · pythonremotewindows
https://www.exploit-db.com/exploits/27568
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16490
metasploit WORKING POC NORMAL
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/vnc/ultravnc_client.rb
exploitdb WRITEUP VERIFIED
by Luigi Auriemma · textremotewindows
https://www.exploit-db.com/exploits/27569

Scores

EPSS 0.8594
EPSS Percentile 99.4%

Classification

CWE
CWE-119
Status draft

Affected Products (2)

ultravnc/tabbed_viewer
ultravnc/vnc_viewer

Timeline

Published Apr 06, 2006
Tracked Since Feb 18, 2026