Unrated severityNVD Advisory· Published Jun 30, 2020· Updated Aug 4, 2024
Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it
CVE-2020-4044
Description
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
27- osv-coords26 versionspkg:rpm/opensuse/xrdp&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/xrdp&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/xrdp&distro=openSUSE%20Tumbleweedpkg:rpm/suse/xrdp&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/xrdp&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/xrdp&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/xrdp&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/xrdp&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/xrdp&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/xrdp&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
< 0.9.6-lp151.4.6.1+ 25 more
- (no CPE)range: < 0.9.6-lp151.4.6.1
- (no CPE)range: < 0.9.13.1-lp152.3.3.1
- (no CPE)range: < 0.9.15-2.2
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.6-4.8.1
- (no CPE)range: < 0.9.6-4.8.1
- (no CPE)range: < 0.9.6-4.8.1
- (no CPE)range: < 0.9.13.1-4.3.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-16.20.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-16.20.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.10-3.3.1
- (no CPE)range: < 0.9.6-4.8.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-16.20.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.10-3.3.1
- (no CPE)range: < 0.9.6-4.8.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-16.20.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- (no CPE)range: < 0.9.0~git.1456906198.f422461-21.27.1
- Range: < 0.9.13.1
Patches
Vulnerability mechanics
References
7- lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00037.htmlmitrevendor-advisoryx_refsource_SUSE
- www.debian.org/security/2020/dsa-4737mitrevendor-advisoryx_refsource_DEBIAN
- github.com/neutrinolabs/xrdp/commit/0c791d073d0eb344ee7aaafd221513dc9226762cmitrex_refsource_MISC
- github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1mitrex_refsource_MISC
- github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4mitrex_refsource_CONFIRM
- lists.debian.org/debian-lts-announce/2020/08/msg00015.htmlmitremailing-listx_refsource_MLIST
News mentions
0No linked articles in our index yet.