CVE-2020-14405: 
NixOS vulnerability analysis and mitigation

An issue was discovered in LibVNCServer before 0.9.13 where libvncclient/rfbproto.c does not limit TextChat size. The vulnerability was assigned CVE-2020-14405 and was disclosed in June 2020. The issue affects multiple versions of LibVNCServer and various systems including Debian, Ubuntu, and Siemens SIMATIC products (Debian LTS, Ubuntu Notice).

The vulnerability exists in the TextChat functionality of LibVNCServer's client component (libvncclient/rfbproto.c). The issue stems from the lack of size limitations on TextChat messages, which could potentially lead to resource exhaustion. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could allow a remote attacker to cause a denial of service condition by sending large TextChat messages. The impact primarily affects the availability of the system, with no direct impact on confidentiality or integrity (Ubuntu Notice).

The vulnerability can be exploited remotely and requires low attack complexity. An attacker needs low privileges and no user interaction to exploit this vulnerability. The attack vector is network-based (NVD).

The vulnerability was fixed in LibVNCServer version 0.9.13 by implementing a maximum size limit of 10MB for TextChat messages. The fix was implemented in commit 8937203441ee241c4ace85da687b7d6633a12365. Various distributions have released patched versions: Ubuntu 20.04 (0.9.12+dfsg-9ubuntu0.2), Ubuntu 18.04 (0.9.11+dfsg-1ubuntu1.3), Ubuntu 16.04 (0.9.10+dfsg-3ubuntu0.16.04.5), and Debian 9 (0.9.11+dfsg-1.3~deb9u5) (GitHub Commit, Ubuntu Notice).