Ubuntu bionic: Update TigerVNC to fix a network information disclosure vulnerability

Ubuntu published USN-9088-1 to fix CVE-2020-26117 in TigerVNC on Ubuntu bionic. See the Ubuntu security notice for details about affected packages and the fixed version.

Overview and technical details

TigerVNC is software for remotely accessing and managing computers using the VNC protocol, and includes viewer and server components. The reported flaw is in how the TigerVNC viewer stores TLS certificate exceptions.

Affected systems

The notice lists TigerVNC packages on Ubuntu bionic. The fixed version is provided through the esm-apps pocket.

Mechanism and impact

The TigerVNC viewer stores TLS certificate exceptions as trusted CAs. After a user adds a certificate exception for an attacker’s VNC server, a remote attacker could exploit the flaw to impersonate any VNC server and potentially expose sensitive information over the network.

System checks

1. Check the versions of TigerVNC packages installed on Ubuntu bionic:

   Copy commands

   dpkg-query -W -f='${binary:Package} ${Version}\n' tigervnc-common tigervnc-scraping-server tigervnc-standalone-server tigervnc-viewer tigervnc-xorg-extension

2. Check Ubuntu Pro status to confirm access to the esm-apps pocket:

   Copy commands

   pro status

Installed packages at version 1.7.0+dfsg-8ubuntu2+esm1 or later have the fix; earlier versions need updating.

Remediation and mitigation

1. Prioritize updating Ubuntu bionic systems using TigerVNC, especially machines with the viewer that have added TLS certificate exceptions.

2. Canonical recommends performing a standard system update to apply the necessary changes. Fixed packages for Ubuntu bionic are available through the esm-apps pocket.