SB2021051314 - Multiple vulnerabilities in Siemens SIMATIC UltraVNC HMI WinCC Products
Published: May 13, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2019-8259)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due memory leak in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it and access sensitive information.
Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.
2) Out-of-bounds read (CVE-ID: CVE-2019-8260)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due to a boundary condition in VNC client RRE decoder code, caused by multiplication overflow. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds read (CVE-ID: CVE-2019-8261)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due to a boundary condition in VNC code inside client CoRRE decoder, caused by multiplication overflow. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds read error and read contents of memory on the system.
4) Heap-based buffer overflow (CVE-ID: CVE-2019-8262)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in VNC client code inside Ultra decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger heap-based buffer overflow and execute arbitrary code with privileges of the user, running the VNC client.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Stack-based buffer overflow (CVE-ID: CVE-2019-8263)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in VNC client code inside ShowConnInfo routine. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger stack-based buffer overflow and cause a denial of service condition on the target system.
6) Out-of-bounds write (CVE-ID: CVE-2019-8264)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in VNC client inside Ultra2 decoder when processing untrusted input. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.
7) Out-of-bounds write (CVE-ID: CVE-2019-8265)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error connected with improper usage of SETPIXELS macro in VNC client code. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.
8) Improper Null Termination (CVE-ID: CVE-2019-8275)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.The vulnerability exists in VNC server code due to the affected software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.
9) Improper Initialization (CVE-ID: CVE-2019-8277)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due to an uninitialized read condition in VNC server code. A remote attacker can read stack memory and disclose sensitive information on the target system.
Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.
10) Out-of-bounds write (CVE-ID: CVE-2019-8280)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in VNC client inside RAW decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger out-of-bounds write and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.