Vulnerability Description
The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| David King | Vino | <= 3.7.3 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2013-1452.html
- http://secunia.com/advisories/55090Vendor Advisory
- http://www.ubuntu.com/usn/USN-1980-1Vendor Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=641811Vendor Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=707905Vendor Advisory
- https://www.trustwave.com/spiderlabs/advisories/TWSL2013-028.txt
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2013-1452.html
- http://secunia.com/advisories/55090Vendor Advisory
- http://www.ubuntu.com/usn/USN-1980-1Vendor Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=641811Vendor Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=707905Vendor Advisory
- https://www.trustwave.com/spiderlabs/advisories/TWSL2013-028.txt
FAQ
What is CVE-2013-5745?
CVE-2013-5745 is a vulnerability with a CVSS score of 7.1 (HIGH). The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error c...
How severe is CVE-2013-5745?
CVE-2013-5745 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-5745?
Check the references section above for vendor advisories and patch information. Affected products include: David King Vino, Canonical Ubuntu Linux.