CVE-2020-4044: 
xrdp vulnerability analysis and mitigation

The vulnerability CVE-2020-4044 affects the xrdp-sesman service in xrdp versions prior to 0.9.13.1. This security issue was discovered by Ashley Newson and disclosed on June 30, 2020. The vulnerability affects the session manager component of xrdp, which is an open-source Remote Desktop Protocol (RDP) server (GitHub Advisory, Debian Advisory).

The vulnerability is a buffer overflow attack that can be triggered by connecting to port 3350 and supplying a malicious payload. The issue stems from incorrect handling of memory when processing certain incoming connections. The vulnerability was addressed by implementing a maximum message size limit of 8192 bytes to prevent memory exhaustion attempts (GitHub Commit).

The exploitation of this vulnerability allows an attacker to crash the xrdp-sesman service and potentially execute arbitrary code. Once the service is compromised, an unprivileged attacker on the server can start their own imposter sesman service listening on port 3350, enabling them to capture user credentials submitted to XRDP, approve or reject arbitrary login credentials, and in the case of xorgxrdp sessions, hijack existing sessions (GitHub Advisory).

The vulnerability requires local access to the system and the ability to connect to port 3350. The attack can be executed by supplying a malicious payload to crash the xrdp-sesman service, after which the attacker can impersonate the service (Debian Advisory).

The vulnerability was fixed in xrdp version 0.9.13.1. Users are strongly recommended to upgrade to this version or later. The fix includes implementation of message size limits to prevent memory exhaustion attempts. Various Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and OpenSUSE (Ubuntu Notice, OpenSUSE Advisory).