CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
26.1%
Debian Security Advisory DSA-4737-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
July 29, 2020 https://www.debian.org/security/faq
Package : xrdp
CVE ID : CVE-2020-4044
Debian Bug : 964573
Ashley Newson discovered that the XRDP sessions manager was susceptible
to denial of service. A local attacker can further take advantage of
this flaw to impersonate the XRDP sessions manager and capture any user
credentials that are submitted to XRDP, approve or reject arbitrary
login credentials or to hijack existing sessions for xorgxrdp sessions.
For the stable distribution (buster), this problem has been fixed in
version 0.9.9-1+deb10u1.
We recommend that you upgrade your xrdp packages.
For the detailed security status of xrdp please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/xrdp
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | armhf | xorgxrdp | < 0.9.1-9+deb9u4 | xorgxrdp_0.9.1-9+deb9u4_armhf.deb |
Debian | 10 | armel | xrdp-dbgsym | < 0.9.9-1+deb10u1 | xrdp-dbgsym_0.9.9-1+deb10u1_armel.deb |
Debian | 10 | ppc64el | xrdp | < 0.9.9-1+deb10u1 | xrdp_0.9.9-1+deb10u1_ppc64el.deb |
Debian | 10 | amd64 | xrdp | < 0.9.9-1+deb10u1 | xrdp_0.9.9-1+deb10u1_amd64.deb |
Debian | 9 | arm64 | xrdp | < 0.9.1-9+deb9u4 | xrdp_0.9.1-9+deb9u4_arm64.deb |
Debian | 10 | mips64el | xrdp | < 0.9.9-1+deb10u1 | xrdp_0.9.9-1+deb10u1_mips64el.deb |
Debian | 10 | arm64 | xrdp-dbgsym | < 0.9.9-1+deb10u1 | xrdp-dbgsym_0.9.9-1+deb10u1_arm64.deb |
Debian | 10 | ppc64el | xrdp-dbgsym | < 0.9.9-1+deb10u1 | xrdp-dbgsym_0.9.9-1+deb10u1_ppc64el.deb |
Debian | 9 | i386 | xrdp | < 0.9.1-9+deb9u4 | xrdp_0.9.1-9+deb9u4_i386.deb |
Debian | 9 | amd64 | xrdp | < 0.9.1-9+deb9u4 | xrdp_0.9.1-9+deb9u4_amd64.deb |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
26.1%