CVE-2017-6967

xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.

Score

CVSS 3.1 7.3 High

Status

Modified - cve@mitre.org

Published

2017-03-17

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Xrdp (Neutrinolabs)

References

• https://bugs.launchpad.net/ubuntu/+source/xrdp/+bug/1672742
• https://github.com/neutrinolabs/xrdp/issues/350
• https://github.com/neutrinolabs/xrdp/pull/694