Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-0388. PoCs published by desi, Andres Luksenberg.
AI-analyzed exploit summary This exploit targets an authentication bypass vulnerability in TightVNC by sending malformed RFB protocol messages to trigger a buffer overflow, potentially leading to remote code execution. It sets up a fake VNC server on port 5900 and sends crafted packets to exploit CVE-2009-0388.
Description
Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.
Exploits (2)
This exploit targets an authentication bypass vulnerability in TightVNC by sending malformed RFB protocol messages to trigger a buffer overflow, potentially leading to remote code execution. It sets up a fake VNC server on port 5900 and sends crafted packets to exploit CVE-2009-0388.
This exploit triggers an integer overflow in UltraVNC and TightVNC clients by sending a malformed RFB protocol response with an excessively large value (0xffffff) during the initial handshake, leading to a denial-of-service (DoS) condition.