xrdp-sesman Service up to 0.9.13.0 Service Port 3350 stack-based overflow

Summaryinfo

A vulnerability was found in xrdp-sesman Service up to 0.9.13.0 and classified as problematic. The affected element is an unknown function of the component Service Port 3350. Executing a manipulation can lead to stack-based overflow. The identification of this vulnerability is CVE-2020-4044. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in xrdp-sesman Service up to 0.9.13.0 and classified as problematic. This vulnerability affects an unknown code of the component Service Port 3350. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect availability. CVE summarizes:

The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.

The weakness was shared 06/30/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability was named CVE-2020-4044 since 12/30/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.9.13.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• xrdp-sesman Service

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.10
• 0.9.11
• 0.9.12
• 0.9.13.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion