Log in Start free

Vulnerability · Published Jun 30, 2020 · Assigned by GitHub_M

CVE-2020-4044Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it

High 7.5

In plain English

A high-severity stack buffer overflow in xrdp from neutrinolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.3%top 16.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xrdp0.9.13.1-r0ALPINE-CVE-2020-4044
Alpine:v3.21xrdp0.9.13.1-r0ALPINE-CVE-2020-4044
Alpine:v3.22xrdp0.9.13.1-r0ALPINE-CVE-2020-4044
Alpine:v3.23xrdp0.9.13.1-r0ALPINE-CVE-2020-4044
Alpine:v3.24xrdp0.9.13.1-r0ALPINE-CVE-2020-4044
Debian:12xrdp0.9.12-1.1DEBIAN-CVE-2020-4044
Debian:13xrdp0.9.12-1.1DEBIAN-CVE-2020-4044
Debian:14xrdp0.9.12-1.1DEBIAN-CVE-2020-4044

Affected products (as reported)

VendorProductVersions
neutrinolabs xrdp < 0.9.13.1

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References