Vulnerability Description
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Neutrinolabs | Xrdp | < 0.9.13.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00037.html
- https://github.com/neutrinolabs/xrdp/commit/0c791d073d0eb344ee7aaafd221513dc9226PatchThird Party Advisory
- https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1Release NotesThird Party Advisory
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00015.html
- https://www.debian.org/security/2020/dsa-4737
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00037.html
- https://github.com/neutrinolabs/xrdp/commit/0c791d073d0eb344ee7aaafd221513dc9226PatchThird Party Advisory
- https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1Release NotesThird Party Advisory
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00015.html
- https://www.debian.org/security/2020/dsa-4737
FAQ
What is CVE-2020-4044?
CVE-2020-4044 is a vulnerability with a CVSS score of 7.5 (HIGH). The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the ser...
How severe is CVE-2020-4044?
CVE-2020-4044 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-4044?
Check the references section above for vendor advisories and patch information. Affected products include: Neutrinolabs Xrdp.