Stack-based buffer overflow in xrdp - CVE-2020-4044
Published: July 21, 2020
Vulnerability identifier: #VU31719
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-4044
CWE-ID: CWE-121
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A local user can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
xrdp
Debian Linux
Ubuntu
Opensuse
xrdp (Ubuntu package)
xrdp (Debian package)
Debian Linux
Ubuntu
Opensuse
xrdp (Ubuntu package)
xrdp (Debian package)
How to mitigate CVE-2020-4044
Install updates from vendor's website.
xrdp - update to 0.9.13.1
xrdp (Ubuntu package) - addressed in versions Ubuntu Pro, 0.9.12-1ubuntu0.1
xrdp (Debian package) - update to 0.9.9-1+deb10u1
xrdp (Ubuntu package) - addressed in versions Ubuntu Pro, 0.9.12-1ubuntu0.1
xrdp (Debian package) - update to 0.9.9-1+deb10u1