CVE-2011-1775

Published: May 26, 2011Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.

Affected (1)

Products: Tigervnc: Tigervnc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tigervnc Tigervnc	Version 1.1 beta1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (22)

http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060567.html

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/05/06/2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/05/09/7

Source: secalert@redhat.com

http://secunia.com/advisories/44939

Source: secalert@redhat.com

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01342.html

Source: secalert@redhat.com

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01345.html

Source: secalert@redhat.com

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01347.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0871.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/47738

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=702470

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=702672

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060567.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/05/06/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/05/09/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/44939

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01342.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01345.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01347.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0871.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/47738

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=702470

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=702672

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.