CVE-2013-1430
critical
CVSS v3
9.8
CVSS v2
5.0
VIR risk
9.8
Description
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2013-1430
Vendor advisory: security@debian.org — https://github.com/neutrinolabs/xrdp/pull/497
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2013-1430.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | 7.0 | affected | |
| debian | 8.0 | affected | |
| debian | bookworm | fixed | 0.9.1~2016121126+git5171fa7-1 |
| debian | bullseye | fixed | 0.9.1~2016121126+git5171fa7-1 |
| debian | forky | fixed | 0.9.1~2016121126+git5171fa7-1 |
| debian | sid | fixed | 0.9.1~2016121126+git5171fa7-1 |
| debian | trixie | fixed | 0.9.1~2016121126+git5171fa7-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| neutrinolabs | xrdp | {"endIncluding":"0.8.0"} | |
References
CWEs
CWE-255
Verify integrity in audit chain (admin only). AS-IS.