Headline
Ubuntu Security Notice USN-6474-1
Ubuntu Security Notice 6474-1 - It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive information. It was discovered that xrdp improperly handled session establishment errors. An attacker could potentially use this issue to bypass the OS-level session restrictions by PAM.
==========================================================================Ubuntu Security Notice USN-6474-1November 08, 2023xrdp vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTS (Available with Ubuntu Pro)- Ubuntu 20.04 LTS (Available with Ubuntu Pro)- Ubuntu 18.04 LTS (Available with Ubuntu Pro)- Ubuntu 16.04 LTS (Available with Ubuntu Pro)- Ubuntu 14.04 LTS (Available with Ubuntu Pro)Summary:Several security issues were fixed in xrdp.Software Description:- xrdp: Remote Desktop Protocol (RDP) serverDetails:It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds reads. An attackercould possibly use this issue to crash the program or extract sensitiveinformation. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,CVE-2023-42822)It was discovered that xrdp improperly handled session establishmenterrors. An attacker could potentially use this issue to bypass theOS-level session restrictions by PAM. (CVE-2023-40184)It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds writes. An attackercould possibly use this issue to cause memory corruption or executearbitrary code. This issue only affected Ubuntu 18.04 LTS,Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds reads. An attackercould possibly use this issue to crash the program or extract sensitiveinformation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTSand Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds reads. An attackercould possibly use this issue to crash the program or extract sensitiveinformation. This issue only affected Ubuntu 20.04 LTS andUbuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds writes. An attackercould possibly use this issue to cause memory corruption or executearbitrary code. This issue only affected Ubuntu 20.04 LTS andUbuntu 22.04 LTS. (CVE-2022-23478)It was discovered that xrdp incorrectly handled validation ofclient-supplied data, which could lead to out-of-bounds reads. An attackercould possibly use this issue to crash the program or extract sensitiveinformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS (Available with Ubuntu Pro): xrdp 0.9.17-2ubuntu2+esm1Ubuntu 20.04 LTS (Available with Ubuntu Pro): xrdp 0.9.12-1ubuntu0.1+esm1Ubuntu 18.04 LTS (Available with Ubuntu Pro): xrdp 0.9.5-2ubuntu0.1~esm2Ubuntu 16.04 LTS (Available with Ubuntu Pro): xrdp 0.6.1-2ubuntu0.3+esm3Ubuntu 14.04 LTS (Available with Ubuntu Pro): xrdp 0.6.0-1ubuntu0.1+esm3In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6474-1 CVE-2022-23468, CVE-2022-23477, CVE-2022-23478, CVE-2022-23479, CVE-2022-23480, CVE-2022-23481, CVE-2022-23482, CVE-2022-23483, CVE-2022-23484, CVE-2022-23493, CVE-2022-23613, CVE-2023-40184, CVE-2023-42822Related news
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
Debian Linux Security Advisory 5502-1 - Multiple security vulnerabilities have been found in xrdp, a remote desktop protocol server. Buffer overflows and out-of-bound writes may cause a denial of service or other unspecified impact.
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade.