CVE-2017-18922
📋 TL;DR
CVE-2017-18922 is a heap-based buffer overflow vulnerability in LibVNCServer's WebSocket handling that allows remote attackers to execute arbitrary code or cause denial of service. It affects servers using LibVNCServer versions prior to 0.9.12 with WebSocket support enabled. This vulnerability is particularly dangerous because it can be exploited without authentication.
💻 Affected Systems
- LibVNCServer
- Any software using LibVNCServer library
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Libvncserver by Libvncserver Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing service disruption and potential system crashes.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls.
🎯 Exploit Status
Exploitation requires sending specially crafted WebSocket frames to vulnerable servers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.12 and later
Vendor Advisory: https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.12
Restart Required: Yes
Instructions:
1. Update LibVNCServer to version 0.9.12 or later. 2. Recompile any applications using LibVNCServer. 3. Restart affected services.
🔧 Temporary Workarounds
Disable WebSocket Support
allDisable WebSocket protocol in LibVNCServer configuration
Configure LibVNCServer with -DWEBSOCKETS=OFF during compilation
Network Filtering
linuxBlock WebSocket connections at network perimeter
iptables -A INPUT -p tcp --dport 5900 -m string --string "Sec-WebSocket-Key" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy Web Application Firewall (WAF) with WebSocket attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check LibVNCServer version and verify if WebSocket support is enabled in configurationCheck Version:
vncserver --version 2>&1 | grep -i libvncVerify Fix Applied:
Verify LibVNCServer version is 0.9.12 or later and test WebSocket functionality📡 Detection & Monitoring
Log Indicators:
- Abnormal WebSocket connection attempts
- Memory allocation errors in server logs
- Process crashes related to LibVNCServer
Network Indicators:
- Malformed WebSocket frames
- Unusual WebSocket traffic patterns
- Exploit-specific payload patterns
SIEM Query:
source="*vnc*" AND (event="crash" OR event="buffer_overflow" OR event="websocket_error")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- http://www.openwall.com/lists/oss-security/2020/06/30/3
- https://bugzilla.redhat.com/show_bug.cgi?id=1852356
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/
- https://usn.ubuntu.com/4407-1/
- https://www.openwall.com/lists/oss-security/2020/06/30/2
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- http://www.openwall.com/lists/oss-security/2020/06/30/3
- https://bugzilla.redhat.com/show_bug.cgi?id=1852356
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/
- https://usn.ubuntu.com/4407-1/
- https://www.openwall.com/lists/oss-security/2020/06/30/2
