CVE-2006-1652
UltraVNC and tabbed_viewer - Buffer Overflow via Long String on TCP Port 5900
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2006-1652.
PoCs published by Metasploit, Luigi Auriemma, including Metasploit module exploits/windows/vnc/ultravnc_client.
AI-analyzed exploit summary This exploit targets a buffer overflow in UltraVNC Win32 Viewer 1.0.1 by sending a maliciously crafted RFB protocol response to trigger remote code execution. It includes payload handling and specific return addresses for different Windows versions.
Description
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.
Exploits (6)
This exploit targets a buffer overflow in UltraVNC Win32 Viewer 1.0.1 by sending a maliciously crafted RFB protocol response to trigger remote code execution. It includes payload handling and specific return addresses for different Windows versions.
This exploit targets a buffer overflow vulnerability in Ultr@VNC <= 1.0.1 client by sending a maliciously crafted RFB protocol response with an oversized error message. It binds to port 5900 and waits for client connections to trigger the overflow.
This exploit targets a buffer overflow vulnerability in Ultr@VNC <= 1.0.1 via a crafted HTTP request. It sends a long string to trigger the overflow, potentially causing a denial-of-service (DoS) condition.
The provided text describes a remote buffer overflow vulnerability in UltraVNC due to improper bounds checking in error-logging functionality. Successful exploitation could lead to arbitrary code execution in the context of the application.
This exploit targets a buffer overflow vulnerability in UltraVNC 1.0.1 by sending a maliciously crafted packet to the VNC server, leading to remote code execution (calc.exe). The PoC uses a standard buffer overflow technique with NOP sleds, a JMP instruction, and shellcode.
This Metasploit module exploits a buffer overflow in UltraVNC Win32 Viewer 1.0.1 by sending a maliciously crafted RFB protocol response to trigger remote code execution. The exploit leverages a stack-based overflow with a controlled return address to execute arbitrary payloads.