CVE-2006-1652
UltraVNC <1.0.1 - Buffer Overflow
Title source: llmDescription
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.
Exploits (6)
exploitdb
WORKING POC
VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1643
exploitdb
WORKING POC
VERIFIED
by Luigi Auriemma · cdoswindows
https://www.exploit-db.com/exploits/1642
exploitdb
WORKING POC
VERIFIED
by Luigi Auriemma · pythonremotewindows
https://www.exploit-db.com/exploits/27568
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16490
metasploit
WORKING POC
NORMAL
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/vnc/ultravnc_client.rb
exploitdb
WRITEUP
VERIFIED
by Luigi Auriemma · textremotewindows
https://www.exploit-db.com/exploits/27569
References (12)
Scores
EPSS
0.8594
EPSS Percentile
99.4%
Classification
CWE
CWE-119
Status
draft
Affected Products (2)
ultravnc/tabbed_viewer
ultravnc/vnc_viewer
Timeline
Published
Apr 06, 2006
Tracked Since
Feb 18, 2026