CVE-2017-6967 in xrdp
Summary
by MITRE
xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2020
The vulnerability identified as CVE-2017-6967 affects xrdp version 0.9.1 and represents a critical flaw in the authentication and session management process. This issue stems from the improper invocation of the PAM function auth_start_session() at a location that violates standard security protocols. The xrdp service, which provides remote desktop protocol functionality for Linux systems, relies heavily on PAM for authentication and session management. When the auth_start_session() function is called at an incorrect timing or location within the authentication flow, it fundamentally disrupts the proper initialization sequence of PAM session modules. This misconfiguration creates a scenario where session management components that should be active and properly configured remain in an uninitialized state, potentially allowing malicious actors to exploit this weakness to bypass critical security controls.
The technical flaw specifically manifests in the improper ordering of PAM function calls within the xrdp authentication flow. According to CWE-664, this represents an improper control of a resource through another interface, as the application does not correctly manage the sequence of operations required for proper session initialization. The auth_start_session() function should typically be invoked after successful authentication but before establishing the actual session, ensuring that all necessary PAM modules are properly loaded and configured. However, in this vulnerable implementation, the function is called at an inappropriate point in the execution flow, causing session modules such as pam_limits.so to fail in their initialization process. This bypass of pam_limits.so is particularly concerning as it allows users to circumvent resource limits and access controls that should normally restrict system access based on user permissions and resource allocation policies.
The operational impact of this vulnerability extends beyond simple authentication bypass to potentially enable privilege escalation and unauthorized system access. When PAM session modules fail to initialize correctly, the security controls they enforce become ineffective, creating opportunities for attackers to manipulate system resources or gain elevated privileges. The vulnerability aligns with ATT&CK technique T1078 which covers legitimate credentials and valid accounts, as an attacker could potentially exploit this flaw to establish sessions with elevated privileges or bypass account restrictions. The implications are significant for enterprise environments where xrdp is commonly used for remote desktop access, as it could allow unauthorized users to access systems with higher privileges than intended, potentially leading to complete system compromise or data exfiltration. Organizations relying on xrdp for remote access may unknowingly provide attackers with a backdoor to bypass standard security controls that should normally prevent such privilege escalation.
Mitigation strategies for CVE-2017-6967 require immediate patching of the xrdp service to version 0.9.2 or later, which contains the corrected implementation of PAM function calls. System administrators should also implement additional monitoring to detect unusual authentication patterns or session initialization failures that might indicate exploitation attempts. The fix addresses the core issue by ensuring that auth_start_session() is called at the proper location within the authentication flow, allowing all PAM session modules to initialize correctly and enforce their respective security controls. Security teams should conduct comprehensive vulnerability assessments to identify systems running affected xrdp versions and ensure all remote desktop services are properly updated. Additionally, implementing network segmentation and access controls around systems using xrdp can provide defense-in-depth measures to limit the potential impact of exploitation attempts, while regular security audits should verify that PAM configurations remain properly enforced after patching.