Apache Guacamole 1.5.3 Integer Overflow in VNC Data Leading to Code Execution
CVE-2023-43826 Published on December 19, 2023
Apache Guacamole: Integer overflow in handling of VNC image buffers
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
Vulnerability Analysis
CVE-2023-43826 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to security@guacamole.apache.org
Report acknowledged by project
Report confirmed by project
Fix completed and merged 34 days later.
Fix tested and confirmed by reporter 1 day later.
Fix released 42 days later.
Weakness Type
Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. An integer overflow or wraparound occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may wrap to become a very small or negative number. While this may be intended behavior in circumstances that rely on wrapping, it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs. This becomes security-critical when the result is used to control looping, make a security decision, or determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.
Products Associated with CVE-2023-43826
Want to know whenever a new CVE is published for Apache Guacamole? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Guacamole:- Before and including 1.5.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.