| Название | UltraVNC 1.6.4.0 Uncontrolled Search Path |
|---|
| Описание | UltraVNC version x.x.x.x (32-bit/x86) fails to securely load the system DLL "cryptbase.dll" by using a relative path or relying on the default Windows DLL search order without mitigation. This allows an attacker with local access to place a malicious cryptbase.dll in a directory that precedes the legitimate System32 path in the search order (such as the application's installation directory, current working directory, or a user-writable location alongside the UltraVNC service executable).
When the vulnerable UltraVNC service (winvnc.exe) loads cryptbase.dll, the malicious DLL is executed in the context of the service process. If the service runs with elevated privileges (SYSTEM or high-integrity, common for VNC servers installed as a service), this results in arbitrary code execution with SYSTEM privileges, enabling actions such as establishing a reverse shell to the attacker's machine, installing persistence mechanisms, or performing further privilege escalation and lateral movement. |
|---|
| Источник | ⚠️ https://drive.google.com/file/d/14ixv_1i4D2VrZWyl4RKsvFcN1AMF_qNx/view |
|---|
| Пользователь | haehanse (UID 95883) |
|---|
| Представление | 25.02.2026 10:28 (7 месяцы назад) |
|---|
| Модерация | 08.03.2026 08:11 (11 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 349754 [UltraVNC 1.6.4.0 на Windows Windows Service cryptbase.dll эскалация привилегий] |
|---|
| Баллы | 20 |
|---|