Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Red Hat 6: RHSA-2017-0630-01 Moderate: TigerVNC DoS & Buffer Overflow

red hat
Calendar Grey March 21, 2017
Scroller Redhat
Red Hat releases a new version of TigerVNC addressing critical vulnerabilities, which involves risks of denial of service and potential buffer overflow exploits.
An update for tigervnc is now available for Red Hat Enterprise Linux 6

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. The tigervnc packages contain a client which allows users to connect to other desktops running a VNC server.
Security Fix(es):
* A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early. (CVE-2016-10207)
* A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service. (CVE-2017-5581)
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory Red Hat moderate severity DoS threat TigerVNC

References

https://access.redhat.com/security/cve/CVE-2016-10207 https://access.redhat.com/security/cve/CVE-2017-5581 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source: tigervnc-1.1.0-24.el6.src.rpm
i386: tigervnc-1.1.0-24.el6.i686.rpm tigervnc-debuginfo-1.1.0-24.el6.i686.rpm tigervnc-server-1.1.0-24.el6.i686.rpm
x86_64: tigervnc-1.1.0-24.el6.x86_64.rpm tigervnc-debuginfo-1.1.0-24.el6.x86_64.rpm tigervnc-server-1.1.0-24.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
i386: tigervnc-debuginfo-1.1.0-24.el6.i686.rpm tigervnc-server-module-1.1.0-24.el6.i686.rpm
noarch: tigervnc-server-applet-1.1.0-24.el6.noarch.rpm
x86_64: tigervnc-debuginfo-1.1.0-24.el6.x86_64.rpm tigervnc-server-module-1.1.0-24.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source: tigervnc-1.1.0-24.el6.src.rpm
noarch: tigervnc-server-applet-1.1.0-24.el6.noarch.rpm
x86_64: tigervnc-1.1.0-24.el6.x86_64.rpm tigervnc-debuginfo-1.1.0-24.el6.x86_64.rpm tigervnc-server-1.1.0-24.el6.x86_64.rpm tigervnc-server-module-1.1.0-24.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: tigervnc-1.1.0-24.el6.src.rpm
i386: tigervnc-1.1.0-24.el6.i686.rpm tigervnc-debuginfo-1.1.0-24.el6.i686.rpm tigervnc-server-1.1.0-24.el6.i686.rpm
ppc64: tigervnc-1.1.0-24.el6.ppc64.rpm tigervnc-debuginfo-1.1.0-24.el6.ppc64.rpm tigervnc-server-1.1.0-24.el6.ppc64.rpm
s390x: tigervnc-1.1.0-24.el6.s390x.rpm

Read the Full Advisory


Advisory ID: RHSA-2017:0630-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0630.html
Issue date: 2017-03-21

Topic

An update for tigervnc is now available for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat moderate severity DoS threat TigerVNC

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, ppc64, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64

Bugs Fixed

1323065 - tigervnc cannot build against xorg-x11-server-source

1378922 - tigervnc-server needs to be rebuilt to re-enable listen-on-tcp behavior in RHEL 6.8

1390458 - New version of tigervnc-server disconnects Xsession when initiated from xinetd

1415712 - CVE-2017-5581 tigervnc: Buffer overflow in ModifiablePixelBuffer::fillRect

1418761 - CVE-2016-10207 tigervnc: VNC server can crash when TLS handshake terminates early

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.