CVE-2013-5745

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.7%

from disclosure to weapon0 days

Published on NVDOct 1

1st PoCSep 17

exploitation probability

8.7%top 5% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28338

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00003.html http://rhn.redhat.com/errata/RHSA-2013-1452.html https://bugzilla.gnome.org/show_bug.cgi?id=641811 https://bugzilla.gnome.org/show_bug.cgi?id=707905 http://secunia.com/advisories/55090 https://www.trustwave.com/spiderlabs/advisories/TWSL2013-028.txt http://www.ubuntu.com/usn/USN-1980-1