Improper Certificate Validation in TigerVNC - CVE-2020-26117

Vulnerability identifier: #VU47533

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26117

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists due to improper TLS certificate validation in rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC. Any previously accepted certificate will be considered trusted, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

TigerVNC
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
openEuler
Ubuntu
tigervnc-common (Ubuntu package)
tigervnc-standalone-server (Ubuntu package)
tigervnc-scraping-server (Ubuntu package)
tigervnc
tigervnc-server-minimal
tigervnc-help
tigervnc-server-applet
tigervnc-server
tigervnc-debuginfo
tigervnc-debugsource
tigervnc-server-module
tigervnc (Red Hat package)
net-misc/tigervnc

Install updates from vendor's website.

TigerVNC - update to 1.11.0
tigervnc-common (Ubuntu package) - update to Ubuntu Pro
tigervnc-standalone-server (Ubuntu package) - update to Ubuntu Pro
tigervnc-scraping-server (Ubuntu package) - update to Ubuntu Pro
tigervnc - update to 1.10.1-6
tigervnc-server-minimal - update to 1.10.1-6
tigervnc-help - update to 1.10.1-6
tigervnc-server-applet - update to 1.10.1-6
tigervnc-server - update to 1.10.1-6
tigervnc-debuginfo - update to 1.10.1-6
tigervnc-debugsource - update to 1.10.1-6
tigervnc-server-module - update to 1.10.1-6
tigervnc (Red Hat package) - update to 1.11.0-6.el8
net-misc/tigervnc - update to 1.12.0-r2

• https://bugzilla.opensuse.org/show_bug.cgi?id=1176733
• https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb
• https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b
• https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba
• https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e
• https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0
• https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html

• MitM attack in TigerVNC
• OpenSUSE Linux update for tigervnc
• OpenSUSE Linux update for tigervnc
• Red Hat Enterprise Linux 8 update for tigervnc
• Ubuntu update for tigervnc
• openEuler 20.03 LTS update for tigervnc
• Gentoo update for TigerVNC