Cloudanix VulnDB

CVE-2017-16927

High · 8.4

CVSS

8.4

EPSS

0.4%

Published

Nov 23, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in session-management software lets a local attacker crash the program or potentially take control of the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Untrusted integer supplied over the input stream is used directly as a write length in scp_v0s_accept, enabling an out-of-bounds write that corrupts memory.

Why it matters to the business

Local users can crash the session manager or execute arbitrary code, leading to denial of service against remote desktop services and potential full host compromise.

How an attack unfolds

An attacker with local access crafts a malicious SCP stream containing an oversized length field, sends it to the session manager listening on the local socket, and triggers the vulnerable write path in libscp_v0.c.

How to fix it

Upgrade affected packages to the fixed versions: argo-cd-fips-2.11 (Chainguard) to 2.11.3-r1, argo-cd-fips-2.11-compat (Chainguard) to 2.11.3-r1, and argo-cd-fips-2.11-repo-server (Chainguard) to 2.11.3-r1. Remove or isolate any remaining instances of the vulnerable xrdp session manager code.

How to confirm the fix worked

Verify package versions match the listed fixed releases, confirm the vulnerable libscp_v0.c code is no longer present, and test that crafted oversized length values no longer cause crashes or memory corruption.

Typical attack path

  1. Obtain local shell or process execution rights on a host running the vulnerable session manager
  2. Craft a malicious input stream with an untrusted integer length field
  3. Deliver the stream to the scp_v0s_accept code path
  4. Trigger memory corruption resulting in crash or code execution

How to detect it

Review local process logs and core dumps for unexpected crashes of the session manager, inspect socket traffic for anomalous length fields, and search filesystem for modified or suspicious xrdp binaries.

What your security team should do

  • Apply the listed package upgrades immediately on all affected Chainguard images
  • Audit systems for any remaining xrdp deployments older than 0.9.5
  • Restrict local access to session-manager sockets until patches are deployed
  • Monitor EPSS and KEV status for any future changes in exploit availability

The record

The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 xrdp 0 0.9.4-3
Debian:12 xrdp 0 0.9.4-3
Debian:13 xrdp 0 0.9.4-3
Debian:7 xrdp 0 0.5.0-2+deb7u2
Mageia:6 xrdp 0 0.9.4-1.mga6
SUSE:Enterprise Storage 4 xrdp 0 0.9.0~git.1456906198.f422461-16.9.3
SUSE:Linux Enterprise Desktop 12 SP4 xrdp 0 0.9.0~git.1456906198.f422461-21.9.1
SUSE:Linux Enterprise Server 12 SP2-LTSS xrdp 0 0.9.0~git.1456906198.f422461-16.9.3
SUSE:Linux Enterprise Server 12 SP4 xrdp 0 0.9.0~git.1456906198.f422461-21.9.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 xrdp 0 0.9.0~git.1456906198.f422461-16.9.3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 xrdp 0 0.9.0~git.1456906198.f422461-21.9.1
SUSE:OpenStack Cloud 7 xrdp 0 0.9.0~git.1456906198.f422461-16.9.3
Ubuntu:18.04:LTS xrdp 0 0.9.5-2
Ubuntu:Pro:14.04:LTS xrdp 0 0.6.0-1ubuntu0.1+esm1
Ubuntu:Pro:16.04:LTS xrdp 0 0.6.1-2ubuntu0.3+esm1
openSUSE:Tumbleweed xrdp 0 0.9.15-2.2

Related vulnerabilities