PT-2023-6794 · Xrdp+7 · Xrdp+7
Gafusss
·
Publicado
2023-08-19
·
Atualizado
2025-09-03
·
CVE-2023-40184
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
xrdp versions prior to 0.9.23
Description
The issue is related to the improper handling of session establishment errors in xrdp, allowing bypassing of OS-level session restrictions. The
auth start session function can return a non-zero value on errors, such as PAM errors, which may result in session restrictions being bypassed. This affects users who use restrictions by PAM, while administrators who do not use these restrictions are not affected.Recommendations
To resolve the issue, upgrade to release version 0.9.23 or later. As a temporary workaround, consider restricting access to the
auth start session function until a patch is available. Additionally, review and adjust PAM settings, such as those in ./etc/security/limits.conf, to minimize the risk of exploitation. There are no known workarounds for this issue other than upgrading to the fixed version.Exploit
Correção
Improper Handling of Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Debian
Linuxmint
Red Os
Suse
Ubuntu
Xrdp