Bug 1227769 (CVE-2024-39917) - VUL-0: CVE-2024-39917: xrdp: attackers can make an infinite number of login attempts despite configuration parameter MaxLoginRetry
Summary: VUL-0: CVE-2024-39917: xrdp: attackers can make an infinite number of login a...
Status: NEW
Alias: CVE-2024-39917
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Daike Yu
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/413983/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-39917:7.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-15 09:04 UTC by SMASH SMASH
Modified: 2024-07-15 09:15 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-07-15 09:04:32 UTC 
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39917
https://www.cve.org/CVERecord?id=CVE-2024-39917
https://github.com/neutrinolabs/xrdp/commit/19c111c74c913ecc6e4ba9a738ed929a79d2ae8f
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-7w22-h4w7-8j5j