PT-2016-3473 · Xrdp+2 · Xrdp+2
Dag-Erling Smørgrav
+1
·
Publicado
2016-12-16
·
Atualizado
2024-06-15
·
CVE-2013-1430
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
xrdp versions prior to 0.9.1
Description
An issue was discovered where the file ~/.vnc/sesman ${username} passwd is created when successfully logging in using RDP into an xrdp session. The content of this file is the equivalent of the user's cleartext password, DES encrypted with a known key.
Recommendations
For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ~/.vnc/sesman ${username} passwd file to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Xrdp