Ubuntu.comUB:CVE-2020-9497CVE-2020-9497
CVSS2
Attack Vector
LOCAL
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:H/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
18.1%
Apache Guacamole 1.1.0 and older do not properly validate datareceived from
RDP servers via static virtual channels. If a userconnects to a malicious
or compromised RDP server, specially-craftedPDUs could result in disclosure
of information within the memory ofthe guacd process handling the
connection.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | guacamole-client | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | guacamole-client | < any | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2020-9497
lists.apache.org/thread.html/r65f75d3d65d1af68141f42071ebb27dda24af3e45570e593c1dbd81f%40%3Cannounce.guacamole.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2020-9497
security-tracker.debian.org/tracker/CVE-2020-9497
www.cve.org/CVERecord?id=CVE-2020-9497
www.openwall.com/lists/oss-security/2020/07/02/2
Related
CVSS2
Attack Vector
LOCAL
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:H/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
18.1%