1. Summary
TeamViewer has released security updates addressing several vulnerabilities affecting TeamViewer Clients.
These vulnerabilities have been resolved in the latest available versions. TeamViewer strongly recommends that all users update to the latest available version as soon as possible.
At the time of publication, TeamViewer is not aware of any active exploitation in the wild.
2. Vulnerability details
I. Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
|
CVE-ID |
|
|
Description |
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root. |
|
CVSS3.1 Score |
Base Score 7.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client and Host
|
II. Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution
|
CVE-ID |
|
|
Description |
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction. |
|
CVSS3.1 Score |
Base Score 8.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client and Host
|
III. Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
|
CVE-ID |
|
|
Description |
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host. |
|
CVSS3.1 Score |
Base Score 8.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client (+ Portable version)
TeamViewer Remote Control (Android) prior V15.83 |
3. Affected software and versions
|
Product
|
Versions
|
Info
|
|---|---|---|
|
TeamViewer Full Client (Windows, Linux, macOS) |
15.83 |
|
|
TeamViewer Host (Windows, Linux, macOS) |
15.83 |
|
|
TeamViewer Portable (Windows) |
15.83 |
|
|
TeamViewer Remote Control App (Android) |
15.83 |
|
Legacy versions
|
Versions
|
Info
|
|---|---|---|
|
Teamviewer Full Client v15.64 (Windows 7 & 8) |
15.64.10 |
|
|
TeamViewer Full Client v14.7 (Windows) |
14.7.48868 |
|
|
TeamViewer Full Client v13.2 (Windows) |
13.2.36231 |
|
|
TeamViewer Full Client v14.7 (Linux) |
14.7.48868 |
|
|
TeamViewer Full Client v13.2 (Linux) |
13.2.154008 |
|
|
TeamViewer Full Client v14.7 (MacOS) |
14.7.48868 |
|
|
TeamViewer Full Client v13.2 (MacOS) |
13.2.154007 |
|
|
Teamviewer Host v15.64 (Windows 7 & 8) |
15.64.10 |
|
|
Teamviewer Host v15.64 (Windows 7 & 8) |
|
|
|
TeamViewer Host v14.7 (Windows) |
14.7.48868 |
|
|
TeamViewer Host v13.2 (Windows) |
13.2.36231 |
|
|
TeamViewer Host v14.7 (Linux) |
14.7.48868 |
|
|
TeamViewer Host v13.2 (Linux) |
13.2.154008 |
|
|
TeamViewer Host v14.7 (macOS) |
14.7.48868 |
|
|
TeamViewer Host v13.2 (macOS) |
13.2.154007 |
4. Solutions and mitigations
Update to the latest version (15.83 or the latest version available)
5. Acknowledgements
We thank the security researchers involved for the discovery and the responsible disclosure. Researchers are explicitly named in the individual CVEs records.