Buffer overflow in Neutrinolabs Xrdp
CVE-2020-4044
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
Vulnerability class: Buffer Overflow
EPSS: 0.024 (82.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Neutrinolabs Xrdp — versions < 0.9.13.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (vendor-advisory, x_refsource_SUSE)
- security-advisories@github.com (vendor-advisory, x_refsource_DEBIAN)
- security-advisories@github.com (mailing-list, x_refsource_MLIST)
- security-advisories@github.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2020-4044?
- CVE-2020-4044 is a high-severity vulnerability in Neutrinolabs Xrdp, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2020-06-30.
- How severe is CVE-2020-4044?
- High severity. CVSS v3 base score is 7.5 out of 10.