CVE-2018-20748
📋 TL;DR
CVE-2018-20748 is a critical heap out-of-bounds write vulnerability in LibVNC client library that allows remote code execution. Attackers can exploit this by sending specially crafted VNC protocol packets to vulnerable clients. Any system using LibVNC versions before 0.9.12 is affected.
💻 Affected Systems
- LibVNC
- Any software using LibVNC library
- VNC clients based on LibVNC
📦 What is this software?
Libvncserver by Libvnc Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attacker to execute arbitrary code with application privileges
Likely Case
Remote code execution leading to system compromise, data theft, or lateral movement
If Mitigated
Denial of service or application crash if exploit fails
🎯 Exploit Status
Exploitation requires the vulnerable client to connect to a malicious server. The vulnerability is in protocol parsing, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.12 and later
Vendor Advisory: https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.12
Restart Required: Yes
Instructions:
1. Update LibVNC to version 0.9.12 or later. 2. Recompile any applications using LibVNC. 3. Restart affected services. 4. For package managers: 'apt-get update && apt-get upgrade libvncserver' or equivalent.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict VNC client connections to trusted servers only
iptables -A OUTPUT -p tcp --dport 5900:5910 -j DROP
iptables -A OUTPUT -p tcp --dport 5900:5910 -m state --state NEW -m multiport --dports 5900:5910 -j ACCEPT -d trusted_server_ip
Application Whitelisting
allPrevent execution of unauthorized binaries that might result from exploitation
🧯 If You Can't Patch
- Isolate VNC clients in separate network segments with strict egress filtering
- Implement application control to prevent execution of unauthorized processes
🔍 How to Verify
Check if Vulnerable:
Check LibVNC version: 'ldconfig -p | grep vnc' and verify version < 0.9.12. Check linked libraries in applications: 'ldd /path/to/application | grep vnc'Check Version:
pkg-config --modversion libvncserver || dpkg -l | grep libvnc || rpm -qa | grep vncVerify Fix Applied:
Verify LibVNC version is 0.9.12 or later: 'pkg-config --modversion libvncserver'. Test with known vulnerable test cases if available.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unexpected process termination of VNC clients
- Memory corruption errors in system logs
Network Indicators:
- Unusual VNC protocol traffic patterns
- Connection attempts to VNC clients from unexpected sources
- Malformed VNC protocol packets
SIEM Query:
source="*vnc*" AND ("segmentation fault" OR "SIGSEGV" OR "heap corruption")🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/a64c3b37af9a6c8f8009d7516874b8d266b42bae
- https://github.com/LibVNC/libvncserver/commit/c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7
- https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
- https://github.com/LibVNC/libvncserver/commit/e34bcbb759ca5bef85809967a268fdf214c1ad2c
- https://github.com/LibVNC/libvncserver/issues/273
- https://lists.debian.org/debian-lts-announce/2019/01/msg00029.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://usn.ubuntu.com/3877-1/
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4587-1/
- https://www.openwall.com/lists/oss-security/2018/12/10/8
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/a64c3b37af9a6c8f8009d7516874b8d266b42bae
- https://github.com/LibVNC/libvncserver/commit/c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7
- https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
- https://github.com/LibVNC/libvncserver/commit/e34bcbb759ca5bef85809967a268fdf214c1ad2c
- https://github.com/LibVNC/libvncserver/issues/273
- https://lists.debian.org/debian-lts-announce/2019/01/msg00029.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://usn.ubuntu.com/3877-1/
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4587-1/
- https://www.openwall.com/lists/oss-security/2018/12/10/8
