CVE-2020-4044 Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it

High 7.5 Published 30 Jun 2020 Updated 4 Aug 2024

Local attackers can crash the xrdp-sesman service via buffer overflow and impersonate it to steal credentials or hijack sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-4044?

CVE-2020-4044 is a high-severity memory corruption vulnerability in neutrinolabs xrdp, published on 30 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.

Weakness: CWE-121

Which versions are affected by CVE-2020-4044?

It affects 1 product.

Linux distribution packages (21)

`xrdp` SUSE:Enterprise Storage 5	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:HPE Helion OpenStack 8	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	All versions	`0.9.6-4.8.1`
`xrdp` SUSE:Linux Enterprise High Performance Computing 15-LTSS	All versions	`0.9.6-4.8.1`
`xrdp` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`0.9.6-4.8.1`
`xrdp` SUSE:Linux Enterprise Module for Basesystem 15 SP2	All versions	`0.9.13.1-4.3.1`
`xrdp` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise Server 12 SP4-LTSS	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise Server 12 SP5	All versions	`0.9.10-3.3.1`
`xrdp` SUSE:Linux Enterprise Server 15-LTSS	All versions	`0.9.6-4.8.1`
`xrdp` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`0.9.10-3.3.1`
`xrdp` SUSE:Linux Enterprise Server for SAP Applications 15	All versions	`0.9.6-4.8.1`
`xrdp` SUSE:OpenStack Cloud 8	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:OpenStack Cloud 9	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:OpenStack Cloud Crowbar 8	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` SUSE:OpenStack Cloud Crowbar 9	All versions	`0.9.0~git.1456906198.f422461-21.27.1`
`xrdp` openSUSE:Leap 15.1	All versions	`0.9.6-lp151.4.6.1`
`xrdp` openSUSE:Leap 15.2	All versions	`0.9.13.1-lp152.3.3.1`

Products include Neutrinolabs Xrdp.

How do I fix CVE-2020-4044?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-4044 being exploited?

There is no known exploitation of CVE-2020-4044 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2020-4044, DLA-2319-1, DSA-4737-1, GHSA-j9fv-6fwf-p3g4, MGASA-2021-0016, SUSE-SU-2020:1918-1 and 7 more.