TigerVNC viewer stores TLS exceptions as trusted certificate authorities
Original title: USN-9088-1: TigerVNC vulnerability
After one certificate exception, a remote attacker could impersonate any VNC server, Ubuntu says.
Ubuntu Security Notice USN-9088-1 says the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. A remote attacker could possibly impersonate any VNC server after a user added a certificate exception for the attacker's server. The snippet gives no versions, fix, or CVE.
- The flaw applies after a user accepts a certificate exception for the attacker's server.
- The stored exception is treated as a trusted certificate authority.
- No affected or fixed versions are stated in the snippet.
Impact: Impersonation of any VNC server after a certificate exception
| Product | Affected |
|---|---|
| TigerVNC viewer | — |
From the original article
It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. A remote attacker could possibly use this issue to impersonate any VNC server after a user had added a certificate exception for the attacker's server.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.