CVE-2018-21247
📋 TL;DR
CVE-2018-21247 is an information leak vulnerability in LibVNCServer where the ConnectToRFBRepeater function exposes uninitialized memory contents. This allows attackers to potentially read sensitive data from server memory. Any system using vulnerable versions of LibVNCServer (0.9.12 and earlier) is affected.
💻 Affected Systems
- LibVNCServer
- Any software using LibVNCServer library
📦 What is this software?
Leap by Opensuse
Libvncserver by Libvnc Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive information like passwords, encryption keys, or other memory-resident data from the VNC server process.
Likely Case
Information disclosure of random memory contents, potentially including fragments of sensitive data or application state.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized connections to VNC services.
🎯 Exploit Status
Exploitation requires establishing a connection to the vulnerable VNC service, but no authentication bypass is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.13 and later
Vendor Advisory: https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.13
Restart Required: Yes
Instructions:
1. Update LibVNCServer to version 0.9.13 or later. 2. Recompile any applications using the library. 3. Restart affected services.
🔧 Temporary Workarounds
Disable VNC Repeater Functionality
allIf VNC repeater functionality is not required, disable it to prevent exploitation.
Configure VNC server to not use repeater mode
Network Segmentation
linuxRestrict network access to VNC services to trusted hosts only.
iptables -A INPUT -p tcp --dport 5900 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 5900 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can connect to VNC services
- Monitor VNC service logs for unusual connection attempts or data leakage
🔍 How to Verify
Check if Vulnerable:
Check LibVNCServer version: ldd --version | grep -i vnc or check package version: dpkg -l | grep libvncserverCheck Version:
pkg-config --modversion libvncserver || find /usr -name "*libvnc*" -exec strings {} \; | grep -i versionVerify Fix Applied:
Verify version is 0.9.13 or higher: libvncserver --version 2>/dev/null || echo "Check package manager"📡 Detection & Monitoring
Log Indicators:
- Unusual VNC connection patterns
- Multiple failed connection attempts to VNC repeater
Network Indicators:
- Unexpected connections to VNC ports (typically 5900+)
- Traffic patterns suggesting memory scraping
SIEM Query:
source="vnc.log" AND (event="connection" OR event="repeater") AND src_ip NOT IN trusted_networks🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://github.com/LibVNC/libvncserver/issues/253
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://github.com/LibVNC/libvncserver/issues/253
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/
