Summary
This host is installed with TigerVNC and is prone to security bypass vulnerability.
Impact
Successful exploitation allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Impact Level: Application
Solution
No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore.
General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.
Insight
The flaw is caused by improper verification of server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.
Affected
TigerVNC version 1.1beta1
References
Severity
Classification
-
CVE CVE-2011-1775 -
CVSS Base Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N
Related Vulnerabilities
- Apple QuickTime Multiple Arbitrary Code Execution Vulnerabilities (Win)
- Brother HL-5370DW Printer 'post/panel.html' Security Bypass Vulnerability
- Apple Safari Webkit Multiple Vulnerabilities - June13 (Mac OS X)
- Apple Mac OS X Denial of Service Vulnerability
- Apache Tomcat Remote Code Execution Vulnerability - Sep14