Uninvited remote maintenance for UltraVNC clients
A security update for vncviewer, part of the UltraVNC server, is intended to prevent attackers from taking control of Windows systems. According to information provided by the development team, a vulnerability, which the developers decline to describe, can be exploited when the vncviewer is running in listening mode or it is connected to a malicious UltraVNC server. As long as the viewer is running in listening mode, a server can establish a connection to it.
The problem also occurs if the DSM plugin for encrypting communications is active, though in this case the attacker must be in possession of a valid key. The server itself is not affected by this problem. According to a report on uvnc.com, the bug is present in version 1.0.2 (stable) and all release candidates 1.0.4 and higher. The developers recommend downloading and installing the viewer update as soon as possible or deactivating listening mode and only connecting to trusted servers.
UltraVNC is a Windows based server client application for accessing the GUI, mouse and keyboard of a remote computer.
- WARNING: vulnerability found in the vncviewer..., security advisory on the uvnc forum