Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2024-5148

Опубликовано: 21 мая 2024
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

Отчет

The severity of this issue is considered moderate rather than important because exploitation requires local access to the system by a malicious user. This limits the attack surface primarily to environments with multiple users sharing the same system. Additionally, the attack vector involves a specific transition phase (from the login screen to the user session) and relies on inadequate validation of session agents using D-Bus methods, which, while significant, does not directly compromise the system's overall security infrastructure. As such, the potential for exploitation is constrained by the necessity for local access and the specific conditions required to exploit the flaw, thereby mitigating its overall impact compared to vulnerabilities that can be exploited remotely or without user interaction.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10gnome-remote-desktopNot affected
Red Hat Enterprise Linux 8gnome-remote-desktopNot affected
Red Hat Enterprise Linux 9gnome-remote-desktopNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-488
https://bugzilla.redhat.com/show_bug.cgi?id=2282003gnome-remote-desktop: inadequate validation of session agents using D-Bus methods may expose RDP TLS certificate

EPSS

Процентиль: 42%
0.002
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 1 года назад

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

CVSS3: 7.5
nvd
больше 1 года назад

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

CVSS3: 7.5
debian
больше 1 года назад

A flaw was found in the gnome-remote-desktop package. The gnome-remote ...

CVSS3: 7.5
github
больше 1 года назад

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

CVSS3: 7.5
fstec
больше 1 года назад

Уязвимость пакета для удаленного подключения к компьютеру GNOME Remote Desktop, связанная с предоставлением элемента данных для ошибочного сеанса, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 42%
0.002
Низкий

7.5 High

CVSS3