TeamViewer Flaw Could Let a Malicious Host Take Over a…

SecurityWeek reported on October 30 that a high-severity flaw in TeamViewer could be used to take over the machine of the person viewing a remote session, typically an IT support technician. The research comes from the security firm Remedio.

The bug is an integer overflow in the remote-control screen processing component of TeamViewer clients. According to Remedio, the host announces its screen dimensions and the viewer uses those numbers to size an in-memory pixel buffer. Nothing caps what arrives over the network, so a host can declare a surface far larger than any real screen. Remedio says that path is reachable in the default configuration, and that a host can force it by refusing to negotiate video codecs.

The result can be a denial of service, with the viewer crashing repeatedly. Remedio also says it managed to execute code on the viewer's system by overwriting a pointer in the corrupted surface.

TeamViewer's advisory says exploitation requires a user to connect to an attacker-controlled or compromised host. The same update fixes an out-of-bounds write in the screen-image decoder on macOS and Linux, which can also be triggered by opening a crafted session recording, and a macOS local privilege escalation flaw. TeamViewer also patched six high-severity local privilege escalation bugs in its Remote Management add-ons. The company says it is not aware of exploitation in the wild.

What defenders should do

Update TeamViewer clients, including Portable and the Android Remote Control app, to the latest release. TeamViewer also published updates for legacy versions.
Update the Remote Management add-ons as well, since those fixes are separate.
Treat inbound support sessions with unknown or unverified hosts as a risk, and confirm who is on the other end before connecting.
Be wary of session recording files from untrusted sources.