CVE-2008-0610
UltraVNC 1.0.2 and 1.0.4 - Stack-based Buffer Overflow in ClientConnection::NegotiateProtocolVersion
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-0610.
PoCs published by Metasploit, including Metasploit module exploits/windows/vnc/ultravnc_viewer_bof.
AI-analyzed exploit summary This exploit targets a buffer overflow in UltraVNC Viewer 1.0.2 by sending a maliciously crafted response to a client connection, leveraging a trusted size integer to overflow a stack-based buffer. It achieves remote code execution by overwriting the return address with a pop/pop/ret gadget.
Description
Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a modified size value.
Exploits (2)
This exploit targets a buffer overflow in UltraVNC Viewer 1.0.2 by sending a maliciously crafted response to a client connection, leveraging a trusted size integer to overflow a stack-based buffer. It achieves remote code execution by overwriting the return address with a pop/pop/ret gadget.
This Metasploit module exploits a buffer overflow in UltraVNC Viewer 1.0.2 by sending a maliciously crafted response to a client connection, triggering a stack-based overflow when the client reads a trusted size into a fixed-length buffer. The exploit leverages a specific minor protocol version (14 or 16) to bypass checks and execute arbitrary payloads.