Improper Input Validation in Apache Guacamole RDP Handling

CVE-2020-9497

Summary

Apache Guacamole versions 1.1.0 and earlier are susceptible to an input validation flaw when handling Remote Desktop Protocol (RDP) connections. This vulnerability arises when the system fails to properly validate data received from RDP servers via static virtual channels. An attacker can exploit this flaw by convincing a user to connect to a compromised RDP server, which could lead to the disclosure of sensitive information stored in the memory of the guacd process that manages these connections. It is crucial for users of Apache Guacamole to implement necessary security patches and upgrades to mitigate this risk.

References