CVE-2020-26117 – This vulnerability in TigerVNC allows attackers... (How to Fix)

Q: What is the severity of CVE-2020-26117?

CVE-2020-26117 has a CVSS score of 8.1 (HIGH). This vulnerability in TigerVNC allows attackers to impersonate any VNC server after a client accepts a TLS certificate exception. When users bypass certificate warnings, the client incorrectly stores those certificates as trusted authorities, enabling man-in-the-middle attacks. This affects all TigerVNC viewers before version 1.11.0.

📋 TL;DR

This vulnerability in TigerVNC allows attackers to impersonate any VNC server after a client accepts a TLS certificate exception. When users bypass certificate warnings, the client incorrectly stores those certificates as trusted authorities, enabling man-in-the-middle attacks. This affects all TigerVNC viewers before version 1.11.0.

💻 Affected Systems

Products:

TigerVNC

Versions: All versions before 1.11.0

Operating Systems: Linux, Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects TigerVNC viewers, not servers. Vulnerability triggers when users accept certificate exceptions.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers can intercept and manipulate all VNC sessions, potentially gaining access to sensitive systems and data through credential theft or remote control.

🟠

Likely Case

Targeted attacks against organizations using TigerVNC where attackers can position themselves as man-in-the-middle, leading to session hijacking and data interception.

🟢

If Mitigated

Limited to environments where certificate warnings are never bypassed or where network segmentation prevents man-in-the-middle positioning.

🌐 Internet-Facing: MEDIUM - Requires man-in-the-middle positioning which is more difficult on internet-facing systems but possible in certain network configurations.

🏢 Internal Only: HIGH - Internal networks often have less stringent certificate validation and easier man-in-the-middle positioning opportunities.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires man-in-the-middle position and user interaction (accepting certificate exception). No public exploit code found in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.11.0 and later

Vendor Advisory: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html

Restart Required: Yes

Instructions:

1. Download TigerVNC 1.11.0 or later from official sources. 2. Uninstall old version. 3. Install new version. 4. Restart any running VNC sessions.

🔧 Temporary Workarounds

Disable certificate exception acceptance

all

Configure TigerVNC to never accept certificate exceptions

# Configure in TigerVNC settings or via command line with appropriate flags

Use certificate pinning

all

Pre-configure trusted certificates to prevent exception prompts

# Pre-populate trusted certificates in TigerVNC configuration

🧯 If You Can't Patch

Train users to never accept certificate exceptions when connecting to VNC servers
Implement network segmentation and monitoring to detect man-in-the-middle attempts

🔍 How to Verify

Check if Vulnerable:

Check TigerVNC version with 'vncviewer --version' or equivalent. If version is below 1.11.0, system is vulnerable.

Check Version:

vncviewer --version

Verify Fix Applied:

After patching, verify version is 1.11.0 or higher and test that certificate exceptions are handled correctly.

📡 Detection & Monitoring

Log Indicators:

Multiple certificate exception acceptances from same client
Unusual certificate authorities in VNC logs

Network Indicators:

Unexpected certificate changes during VNC sessions
Man-in-the-middle detection alerts

SIEM Query:

source="tigervnc" AND (event="certificate_exception" OR event="certificate_warning")

📊 Metadata

CVE ID: CVE-2020-26117

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE: CWE-295

Published: September 27, 2020

Last Updated: November 21, 2024

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html Broken Link,Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.html Broken Link,Mailing List,Third Party Advisory
https://bugzilla.opensuse.org/show_bug.cgi?id=1176733 Issue Tracking,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 Release Notes,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html Broken Link,Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.html Broken Link,Mailing List,Third Party Advisory
https://bugzilla.opensuse.org/show_bug.cgi?id=1176733 Issue Tracking,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e Patch,Third Party Advisory
https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 Release Notes,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-26117, you might also want to check these: