In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as authorities, meaning that the owner of a     certificate could impersonate any server after a client had added an exception. (CVE-2020-26117)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202407-14 (TigerVNC: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in TigerVNC. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1783 advisory.

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as authorities, meaning that the owner of a     certificate could impersonate any server after a client had added an exception. (CVE-2020-26117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5965-1 advisory.

    It was discovered that TigerVNC mishandled TLS certificate exceptions. An attacker could use this     vulnerability to impersonate any server after a client had added an exception and obtain sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has tigervnc packages installed that are affected by a vulnerability:

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as authorities, meaning that the owner of a     certificate could impersonate any server after a client had added an exception. (CVE-2020-26117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1783 advisory.

    [1.11.0-6]
    - Use GNOME as default session       Resolves: bz#1853608

    [1.11.0-5]
    - Make sure we log properly output to journal (actually log to syslog)       Resolves: bz#1841537

    [1.11.0-4]
    - Make sure we log properly output to journal       Resolves: bz#1841537

    [1.11.0-3]
    - vncserver: ignore new 'session' parameter from the new systemd support       Resolves: bz#1897504

    [1.11.0-2]
    - Revert removal of vncserver       Resolves: bz#1897504
    - Correctly start vncsession as a daemon       Resolves: bz#1897498

    [1.11.0-1]
    - Update to 1.11.0       Resolves: bz#1880985
    - Backport fix to allow Tigervnc use boolean values in config files       Resolves: bz#1883415

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1783 advisory.

  - tigervnc: certificate exceptions stored as authorities (CVE-2020-26117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1783 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    The following packages have been upgraded to a later upstream version: tigervnc (1.11.0). (BZ#1880985)

    Security Fix(es):

    * tigervnc: certificate exceptions stored as authorities (CVE-2020-26117)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc fixes the following issues :

CVE-2020-26117: Server certificates were stored as certiticate authorities, allowing malicious owners of these certificates to impersonate any server after a client had added an exception (bsc#1176733).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc fixes the following issues :

CVE-2020-26117: Server certificates were stored as certiticate authorities, allowing malicious owners of these certificates to impersonate any server after a client had added an exception (bsc#1176733)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc fixes the following issues :

  - CVE-2020-26117: Server certificates were stored as     certiticate authorities, allowing malicious owners of     these certificates to impersonate any server after a     client had added an exception (bsc#1176733)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

According to the version of the tigervnc package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered in tigernvc, a Virtual Network Computing client and server implementation. The viewer implementation mishandles TLS certificate exceptions, storing the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

For Debian 9 stretch, this problem has been fixed in version 1.7.0+dfsg-7+deb9u2.

We recommend that you upgrade your tigervnc packages.

For the detailed security status of tigervnc please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tigervnc

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
229902	Linux Distros Unpatched Vulnerability : CVE-2020-26117	Nessus	Misc.	high
201916	GLSA-202407-14 : TigerVNC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
184868	Rocky Linux 8 : tigervnc (RLSA-2021:1783)	Nessus	Rocky Linux Local Security Checks	high
173051	Ubuntu 20.04 ESM : TigerVNC vulnerability (USN-5965-1)	Nessus	Ubuntu Local Security Checks	high
167495	NewStart CGSL MAIN 6.02 : tigervnc Vulnerability (NS-SA-2022-0084)	Nessus	NewStart CGSL Local Security Checks	high
149917	Oracle Linux 8 : tigervnc (ELSA-2021-1783)	Nessus	Oracle Linux Local Security Checks	high
149753	CentOS 8 : tigervnc (CESA-2021:1783)	Nessus	CentOS Local Security Checks	high
149674	RHEL 8 : tigervnc (RHSA-2021:1783)	Nessus	Red Hat Local Security Checks	high
146755	EulerOS 2.0 SP2 : tigervnc (EulerOS-SA-2021-1369)	Nessus	Huawei Local Security Checks	high
146169	EulerOS 2.0 SP5 : tigervnc (EulerOS-SA-2021-1237)	Nessus	Huawei Local Security Checks	high
145143	EulerOS 2.0 SP3 : tigervnc (EulerOS-SA-2021-1127)	Nessus	Huawei Local Security Checks	high
144149	EulerOS 2.0 SP8 : tigervnc (EulerOS-SA-2020-2536)	Nessus	Huawei Local Security Checks	high
143839	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:2898-1)	Nessus	SuSE Local Security Checks	high
143679	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:2881-1)	Nessus	SuSE Local Security Checks	high
143652	SUSE SLES15 Security Update : tigervnc (SUSE-SU-2020:2882-1)	Nessus	SuSE Local Security Checks	high
143643	SUSE SLED15 / SLES15 Security Update : tigervnc (SUSE-SU-2020:2880-1)	Nessus	SuSE Local Security Checks	high
142537	openSUSE Security Update : tigervnc (openSUSE-2020-1841)	Nessus	SuSE Local Security Checks	high
142274	EulerOS 2.0 SP9 : tigervnc (EulerOS-SA-2020-2422)	Nessus	Huawei Local Security Checks	high
142230	EulerOS 2.0 SP9 : tigervnc (EulerOS-SA-2020-2440)	Nessus	Huawei Local Security Checks	high
141462	openSUSE Security Update : tigervnc (openSUSE-2020-1666)	Nessus	SuSE Local Security Checks	high
141246	Debian DLA-2396-1 : tigervnc security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-26117

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high