CVE-2019-8263

Published: Mar 5, 2019Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This vulnerability has been fixed in revision 1206.

Affected (4)

Products: Uvnc: Ultravnc · Siemens: Sinumerik Access Mymachine/p2p, Sinumerik Pcu Base Win10 Software/ipc, Sinumerik Pcu Base Win7 Software/ipc

1 product

3 products

Sinumerik Access Mymachine/p2p

Sinumerik Pcu Base Win10 Software/ipc

Sinumerik Pcu Base Win7 Software/ipc

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Uvnc Ultravnc	Before 1.2.2.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinumerik Access Mymachine/p2p	Before 4.8
Siemens Sinumerik Pcu Base Win10 Software/ipc	Before 14.00
Siemens Sinumerik Pcu Base Win7 Software/ipc	Up to 12.01

Related CWEs

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (14)

https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

Source: vulnerability@kaspersky.com

https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf

Source: vulnerability@kaspersky.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf

Source: vulnerability@kaspersky.com

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-009-ultravnc-access-of-memory-location-after-end-of-buffer/

Source: vulnerability@kaspersky.com

Not ApplicableThird Party Advisory

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-010-ultravnc-stack-based-buffer-overflow/

Source: vulnerability@kaspersky.com

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11

Source: vulnerability@kaspersky.com

https://www.us-cert.gov/ics/advisories/icsa-20-161-06

Source: vulnerability@kaspersky.com

Third Party AdvisoryUS Government Resource

https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-009-ultravnc-access-of-memory-location-after-end-of-buffer/

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableThird Party Advisory

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-010-ultravnc-stack-based-buffer-overflow/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.us-cert.gov/ics/advisories/icsa-20-161-06

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.