Ubuntu gnome-control-center Remote Desktop Sharing Enabled by Default Vulnerability

A vulnerability exists in Ubuntu's configuration of gnome-control-center, where Remote Desktop Sharing is enabled by default. This issue arises because the gnome-remote-desktop systemd user service is always running, which can unintentionally open remote desktop ports, creating a potential security risk. The vulnerability affects Ubuntu 22.04 LTS (Jammy) and was introduced in the gnome-remote-desktop package version 42.1.1-2ubuntu1.

Impact

The vulnerability can lead to remote desktop sharing being activated without user consent, potentially allowing unauthorized access to the user's desktop environment.

Reproduction

After a clean installation of Ubuntu 22.04 LTS, the gnome-remote-desktop user service is active by default, contrary to Ubuntu's policy of not having listening services after installation. This can be verified by checking the status of the gnome-remote-desktop.service, which will show it as 'active (running)'.

Remediation

Users can update to gnome-remote-desktop version 42.1.1-2ubuntu1 to address this vulnerability.