CVE-2013-1430
CriticalSummary
An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.
Risk Assessment
Organizations may be exposed to the disclosure of user passwords, potentially leading to unauthorized access to systems. This poses a serious threat to data security and IT infrastructure.
Recommendation
It is recommended to upgrade xrdp to version 0.9.1 or later to mitigate this vulnerability. Additionally, consider implementing stronger password encryption methods.
Original NVD description (English source)
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.