CVE-2019-8277
Summary
| CVE | CVE-2019-8277 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-03-08 23:29:00 UTC |
| Updated | 2021-06-28 13:15:00 UTC |
| Description | UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212. |
Risk And Classification
Problem Types: CWE-665
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Siemens | Sinumerik Access Mymachine/p2p | All | All | All | All |
| Application | Siemens | Sinumerik Access Mymachine/p2p | All | All | All | All |
| Application | Siemens | Sinumerik Access Mymachine/p2p | All | All | All | All |
| Application | Siemens | Sinumerik Pcu Base Win10 Software/ipc | All | All | All | All |
| Application | Siemens | Sinumerik Pcu Base Win10 Software/ipc | All | All | All | All |
| Application | Siemens | Sinumerik Pcu Base Win10 Software/ipc | All | All | All | All |
| Application | Siemens | Sinumerik Pcu Base Win7 Software/ipc | All | All | All | All |
| Application | Siemens | Sinumerik Pcu Base Win7 Software/ipc | All | All | All | All |
| Application | Uvnc | Ultravnc | All | All | All | All |
| Application | Uvnc | Ultravnc | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| KLCERT-19-024: UltraVNC Improper Initialization | Kaspersky Lab ICS CERT | CONFIRM | ics-cert.kaspersky.com | Third Party Advisory |
| cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf | CONFIRM | cert-portal.siemens.com | Third Party Advisory |
| Siemens SIMATIC UltraVNC HMI WinCC Products | CISA | MISC | us-cert.cisa.gov | |
| Siemens SINUMERIK | CISA | MISC | www.us-cert.gov | Third Party Advisory, US Government Resource |
| cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf | CONFIRM | cert-portal.siemens.com | |
| cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf | CONFIRM | cert-portal.siemens.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.