Remote Code Execution (RCE) Affecting org.apache.guacamole:guacamole Open this link in a new tab package, versions [,1.2.0)
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGAPACHEGUACAMOLE-575220
-
published
2 Jul 2020
-
disclosed
2 Jul 2020
-
credit
Unknown
How to fix?
Upgrade org.apache.guacamole:guacamole
to version 1.2.0 or higher.
Overview
org.apache.guacamole:guacamole is a clientless remote desktop gateway.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). The package may mishandle pointers involved in processing data received via RDP static virtual channels. If a user connects to a malicious or compromised RDP server, a series of specially-crafted PDUs could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running process.