TigerVNC vulnerability allows remote server impersonation via TLS certificate errors

A security vulnerability has been identified in TigerVNC that could allow a remote attacker to expose sensitive information over a network. The issue stems from how the TigerVNC viewer manages TLS certificate exceptions, which are incorrectly stored as trusted certificate authorities.

This flaw affects users of the TigerVNC viewer on Ubuntu 18.04 LTS. If a user manually adds a certificate exception for a specific server, the software treats that exception with the same level of trust as a legitimate certificate authority, enabling an attacker to impersonate any VNC server to that user.

Technical details of CVE-2020-26117

• Defect Class: Improper handling of TLS certificate exceptions where exceptions are promoted to trusted certificate authorities.
• Attack Vector: A remote attacker can exploit this to perform man-in-the-middle attacks by impersonating a VNC server.
• Affected Components: The vulnerability impacts the TigerVNC viewer, as well as related packages including tigervnc-common, tigervnc-scraping-server, tigervnc-standalone-server, and tigervnc-xorg-extension.
• Mitigation: Fixes are provided via Ubuntu Pro through ESM Apps for version 1.7.0+dfsg-8ubuntu2+esm1.

Why it matters

This vulnerability highlights the risks of improper certificate validation in remote desktop protocols. For administrators using legacy Ubuntu 18.04 systems, securing TigerVNC requires an active Ubuntu Pro subscription to access the necessary ESM security patches.