UltraVNC 1.2.0.3 (Security update) - Download links

[Rudi De Vos]

impact: all pre 1.2.0.3 versions
exploit: localuser (guest) can gain local admin access on win8


- https://uvnc.eu/download/1203/UltraVNC_ ... _Setup.exe
- https://uvnc.eu/download/1203/UltraVNC_ ... _Setup.exe
- https://uvnc.eu/download/1203/Uvnc_1203_bin.zip

[Nick_od]

good afternoon.
found error.
system windows xp 32 bit winvnc.exe (v1_2_03)
"SecureVNCPlugin.dsm" when you press the button "Config."
then change the password - the password is not possible to change
set up a new password does not save

in version winvnc.ehe (v1_2_02) to save your password is working properly

[Rudi De Vos]

This part needed to be changed to fix the exploit.
The config is now started as desktop user...

*This don't work for domain admins, a service can not impersonate the desktop user

1)logon as local admin
or
2)Use uvnc_settings.exe to make the changes.

Service and change settings via the tray should be removed in the future to force people
to use the sapereate app for it. Sorry

[Nick_od]

1)logon as local admin
or
2)Use uvnc_settings.exe to make the changes.

password is not changed
tried the first and second option

[Rudi De Vos]

Correct, seems i missed the return info from the plugin config... passphraze is not saved.

[Rudi De Vos]

reuploaded files with fixed config savings

[SiUK]

Many thanks for updating the software and resolving the security bug. Is there a .MSI version of the installer or is that coming soon?

Thanks,
Si.

[Rudi De Vos]

Not yet, we made 1.2.0.3 available as soon as possible.
Msi still need to be created

[Nick_od]

reuploaded files with fixed config savings

Hi
A new version i checked
system windows xp 32 bit winvnc.exe (v1_2_03 new)
"SecureVNCPlugin.dsm" when you press the button "Config."
then change the password - the password is change
but if I connect at the password prompt I can hit only 8 characters
(if the password is longer than I can enter 8 characters and log in)
system windows xp 32 bit vncviewer.exe (v1_2_03 new)

A new version i checked uvnc_settings.exe (v1_2_03 new)
"SecureVNCPlugin.dsm" when you press the button "Config."
the password is change and all work fine
(if I connect at the password prompt I can hit more 8 characters and all work fine)

[Rudi De Vos]

I tried to repeat it without luck

1) removed ultravnc.ini
2) started winvnc.exe (app)
3) In the properties window i set passwd, select use dsm plugin and press config
4) save passwd in config
ultravnc.ini is cerated with a single line that indicate the saved options

Code: Select all

[admin]
DSMPluginConfig=SecureVNC;0;0x00104001;123456789==

5)press OK in properties dialog
Now all the other options in ultravnc.ini are set

When i connect the viewer ( selecting plugin) i have >8 chars and the window indicate

Code: Select all

passwd requested
AES-256....

All is in the ultravnc.ini, do you see a difference between the uvnc_settings saved versiona and the
version created with the tray icon.

[Nick_od]

2) started winvnc.exe (app)

You need start winvnc.exe as service
then in the tray select (admin properties) then SecureVNCPlugin.dsm (Config.)
AES(128.....
256 bit
RSA-2048
(use new key algorithm.....)
Passphrase: enter password 9 chars
Confirm: enter password 9 chars
save this
then When you connect the viewer (selecting plugin)
password prompt
you can not enter >8 chars

[Rudi De Vos]

You need start winvnc.exe as service
then in the tray select (admin properties) then SecureVNCPlugin.dsm (Config.)
...
Confirm: enter password 9 chars
save this

Please press config again... is the value realy saved... do you see the extra line

Code: Select all

DSMPluginConfig=SecureVNC;0;0x00104001;123456789==

in the ultravnc.ini

When i'm correct, the problem is that running as service we use the credentials of the current desktop user.
1) We need to get the credentials... this fail for domain users
2) The desktop user need to be admin or he can not save ultravnc.ini

If value is not saved in ini, then winvnc ask the default vnc passwd that's 8 chars.

As we can not bypass 1) and 2) we
need to add some extra check... that popup when desktop user can not be impersonate.
And guide the users to use the uvnc_settings.exe.

[Nick_od]

after save (uvnc_settings.exe)
DSMPluginConfig=SecureVNC;0;0x00104001;MTIzNDU2Nzg5 (123456789)

after
then in the tray select (admin properties) then SecureVNCPlugin.dsm (Config.)
Confirm: enter password 9 chars (123456789)
save and open (ultravnc.ini)
DSMPlugin=SecureVNCPlugin.dsm (empty)
no password
why is this happening?

[Rudi De Vos]

Desktop user permission

The dsm config run as impersonated desktop user, 2 possible reasons
1° User can nor save
2° User can not be imperonate ( domain users can not be impersonate by local service)

[Kirck]

Vnc session hangs up when I type "\" char inside a textbox or in explorer's address bar in remote session.

[Rudi De Vos]

Please verify if this is fixed in
viewtopic.php?t=31133