QwikSec

Security Database

CVE

CWE

Training

CVE-2020-9497

Published: Jul 2, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compromised RDP server, specially-craftedPDUs could result in disclosure of information within the memory ofthe guacd process handling the connection.

Vendor	Product	Versions
n/a	Apache Guacamole	affected `Apache Guacamole 1.1.0 and older`

References

https://lists.apache.org/thread.html/r65f75d3d65d1af68141f42071ebb27dda24af3e45570e593c1dbd81f%40%3Cannounce.guacamole.apache.org%3E

x_refsource_MISC

[announce] 20200701 [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels

mailing-list

x_refsource_MLIST

[guacamole-user] 20200703 Re: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels

mailing-list

x_refsource_MLIST

[guacamole-user] 20200703 RE: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels

mailing-list

x_refsource_MLIST

https://research.checkpoint.com/2020/apache-guacamole-rce/

x_refsource_MISC

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525

x_refsource_CONFIRM

[debian-lts-announce] 20201106 [SECURITY] [DLA 2435-1] guacamole-server security update

mailing-list

x_refsource_MLIST

FEDORA-2020-bfde0ab889

vendor-advisory

x_refsource_FEDORA

FEDORA-2020-640645e518

vendor-advisory

x_refsource_FEDORA

[announce] 20210125 Apache Software Foundation Security Report: 2020

mailing-list

x_refsource_MLIST

[announce] 20210223 Re: Apache Software Foundation Security Report: 2020

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.