CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23478 – Out of Bound Write in xrdp
https://notcve.org/view.php?id=CVE-2022-23478
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade. xrdp es un proyecto de código abierto que proporciona un inicio de sesión gráfico para máquinas remotas utilizando Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contiene una escritura fuera de los límites en la función xrdp_mm_trans_process_drdynvc_channel_open(). No se conocen workarounds para este problema. Se recomienda a los usuarios que actualicen. • https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2f49-wwpm-78pj https://www.debian.org/security/2023/dsa-5502 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23468 – Buffer Overflow in xrdp
https://notcve.org/view.php?id=CVE-2022-23468
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade. xrdp es un proyecto de código abierto que proporciona un inicio de sesión gráfico para máquinas remotas utilizando Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contiene un flujo de búfer desbordado en la función xrdp_login_wnd_create(). No se conocen workarounds para este problema. Se recomienda a los usuarios que actualicen. • https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6 https://www.debian.org/security/2023/dsa-5502 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23493 – Out of Bound Read in xrdp
https://notcve.org/view.php?id=CVE-2022-23493
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade. xrdp es un proyecto de código abierto que proporciona un inicio de sesión gráfico para máquinas remotas utilizando Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contiene una lectura fuera de los límites en la función xrdp_mm_trans_process_drdynvc_channel_close(). No se conocen workarounds para este problema. Se recomienda a los usuarios que actualicen. • https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-59wp-3wq6-jh5v https://www.debian.org/security/2023/dsa-5502 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4044 – Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it
https://notcve.org/view.php?id=CVE-2020-4044
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00037.html https://github.com/neutrinolabs/xrdp/commit/0c791d073d0eb344ee7aaafd221513dc9226762c https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1 https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4 https://lists.debian.org/debian-lts-announce/2020/08/msg00015.html https://www.debian.org/security/2020/dsa-4737 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-16927
https://notcve.org/view.php?id=CVE-2017-16927
The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. La función scp_v0s_accept en sesman/libscp/libscp_v0.c en el administrador de sesión en xrdp hasta la versión 0.9.4 emplea un entero no fiable como longitud de escritura. Esto permite que usuarios locales provoquen una denegación de servicio (desbordamiento de búfer y cierre inesperado de la aplicación) o que, posiblemente, causen otro impacto sin especificar mediante un flujo de entrada manipulado. • https://github.com/neutrinolabs/xrdp/pull/958 https://groups.google.com/forum/#%21topic/xrdp-devel/PmVfMuy_xBA https://lists.debian.org/debian-lts-announce/2017/12/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •