This bug involves asking the VNC server to create a frame buffer (i.e. The relevant messages are VncPointerEvent, VncSetPixelFormat, and VncFrameBufferUpdateRequest. It is in this set of message that the vulnerability resides. As specified in the RFB protocol all VNC servers have to support a standard set of VNC messages. TALOS-2017-0369/CVE-2017-4941 is a code execution vulnerability residing in the remote management functionality of VMWare. The vulnerability resides in the way the VNC server handles this data and results in a heap corruption that can lead to code execution.įor more technical details, please read our advisory here. This VMWDynResolution request is one of the few requests that causes the VNC server to read in a user-supplied data. This vulnerability lies in one of these new features, VNWDynResolution, specifically in the VMWDynResolution request. Along with the standard VNC messages that all VNC server are required to support VMWare uses a custom and proprietary VNC extension that implements new VNC features and also reworks some standard ones. TALOS-2017-0368/CVE-2017-4933 is a code execution vulnerability residing in the remote management functionality of VMWare. For more details about the Decept Proxy and Mutiny Fuzzers see our recent blog.ĭiscovered by Lilith Wyatt of Cisco Talos TALOS-2017-0368 This all occurs without knowing anything about the VMWare specific protocol extensions. By utilizing these tools fuzzing was quickly able to take place by generating VNC traffic, feeding it through the Decept Proxy, and finally fuzzing the resulting. These vulnerabilities were identified using the recently released Decept Proxy and Mutiny Fuzzers. Additionally, Talos has developed Snort signatures that can detect attempts to exploit these vulnerabilities. Talos has coordinated with VMWare to ensure the issue was disclosed responsibly and patched by the vendor.

The vulnerabilities manifest themselves in a way that would allow an attacker to initiate of VNC session causing the vulnerabilities to be triggered. VMWare implements VNC for its remote management, remote access, and automation purposes in VMWare products including Workstation, Player, and ESXi which share a common VMW VNC code base. Today, Talos is disclosing a pair of vulnerabilities in the VNC implementation used in VMWare's products that could result in code execution. UPDATE : Added details for Talos-2017-0376/CVE-2018-6957 which has been recently patched.

Vmware vnc connection