CVE-2020-14397
📋 TL;DR
CVE-2020-14397 is a NULL pointer dereference vulnerability in LibVNCServer's rfbregion.c that can cause denial of service (crash) when processing malicious VNC client requests. This affects any application using vulnerable versions of LibVNCServer for VNC server functionality. The vulnerability is triggered by specially crafted VNC protocol messages.
💻 Affected Systems
- LibVNCServer
- Any software using LibVNCServer library
📦 What is this software?
Leap by Opensuse
Libvncserver by Libvnc Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this is unlikely given the nature of NULL pointer dereference vulnerabilities.
Likely Case
Denial of service causing the VNC server to crash, disrupting remote access services.
If Mitigated
Minimal impact if proper network segmentation and access controls prevent unauthorized VNC connections.
🎯 Exploit Status
Exploitation requires sending specially crafted VNC protocol messages to the vulnerable server. No authentication is needed if VNC server allows unauthenticated connections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.13 and later
Vendor Advisory: https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0
Restart Required: Yes
Instructions:
1. Update LibVNCServer to version 0.9.13 or later. 2. Recompile any applications using LibVNCServer with the updated library. 3. Restart VNC server services.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to VNC server ports using firewall rules
iptables -A INPUT -p tcp --dport 5900:5910 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 5900:5910 -j DROP
VNC Authentication Enforcement
allRequire strong authentication for all VNC connections
Configure VNC server to require password authentication and disable anonymous access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate VNC servers from untrusted networks
- Deploy intrusion detection/prevention systems to monitor for VNC protocol anomalies
🔍 How to Verify
Check if Vulnerable:
Check LibVNCServer version: ldd /path/to/vncserver | grep vnc or check package version with package managerCheck Version:
dpkg -l | grep libvncserver or rpm -qa | grep libvncserver or libvncserver-config --versionVerify Fix Applied:
Verify LibVNCServer version is 0.9.13 or higher: libvncserver-config --version or check installed package version📡 Detection & Monitoring
Log Indicators:
- VNC server crash logs
- Segmentation fault errors in system logs
- Unexpected VNC service restarts
Network Indicators:
- Unusual VNC protocol traffic patterns
- Multiple connection attempts to VNC port
- Malformed VNC protocol packets
SIEM Query:
source="vnc.log" AND (error OR crash OR segfault) OR destination_port=5900 AND protocol_anomaly=true🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html
- https://usn.ubuntu.com/4434-1/
- https://usn.ubuntu.com/4573-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html
- https://usn.ubuntu.com/4434-1/
- https://usn.ubuntu.com/4573-1/
