Vulnerability · Published Jul 2, 2020 · Assigned by apache
CVE-2020-9498
Medium 6.7
In plain English
A medium-severity security flaw in Apache Guacamole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS NVD)6.7Medium
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed with the privileges of therunning guacd process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Guacamole | Apache Guacamole 1.1.0 and older |
References
- https://lists.apache.org/thread.html/rff824b38ebd2fddc726b816f0e509696b83b9f78979d0cd021ca623b%40%3Cannounce.guacamole.apache.org%3E x_refsource_MISC
- [announce] 20200701 [SECURITY] CVE-2020-9498: Apache Guacamole: Dangling pointer in RDP static virtual channel handling mailing-list, x_refsource_MLIST
- https://research.checkpoint.com/2020/apache-guacamole-rce/ x_refsource_MISC
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525 x_refsource_CONFIRM
- [debian-lts-announce] 20201106 [SECURITY] [DLA 2435-1] guacamole-server security update mailing-list, x_refsource_MLIST
- FEDORA-2020-bfde0ab889 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-640645e518 vendor-advisory, x_refsource_FEDORA
- [announce] 20210125 Apache Software Foundation Security Report: 2020 mailing-list, x_refsource_MLIST
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020 mailing-list, x_refsource_MLIST