CVE-2020-25708: 
NixOS vulnerability analysis and mitigation

A divide by zero issue was discovered in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service (NVD, Debian Security).

The vulnerability exists in the rfbSendRectEncodingRaw function within libvncserver/rfbserver.c. The issue occurs due to missing checks that could lead to a divide by zero condition. The vulnerability has a CVSS v3.1 Base Score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with no privileges or user interaction required (NVD, Ubuntu Security).

When successfully exploited, this vulnerability can lead to a denial of service condition through a floating point exception. The impact is limited to availability, with no effect on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered by sending a specially crafted message to the VNC server. The attack vector is network-based and requires no authentication or user interaction, making it relatively easy to exploit (Red Hat Bugzilla).

The vulnerability has been fixed in libvncserver version 0.9.13. Various distributions have released security updates to address this issue, including Ubuntu, Debian, and Red Hat. Users are recommended to upgrade to the patched versions available through their respective package managers (Debian LTS).

Commercial firewalls have flagged TurboVNC connections as potentially vulnerable to this CVE, although testing has shown that only LibVNCServer was affected among TightVNC-compatible code bases. TightVNC 1.3.x, TigerVNC, and TurboVNC were reportedly not vulnerable to this issue (Red Hat Bugzilla).