The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4815-1 advisory.

  - The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses     an untrusted integer as a write length, which allows local users to cause a denial of service (buffer     overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
    (CVE-2017-16927)

  - xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session     modules not being properly initialized, with a potential consequence of incorrect configurations or     elevation of privileges, aka a pam_limits.so bypass. (CVE-2017-6967)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xrdp fixes the following issues :

Security issues fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

Other issues addressed: The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506)

Fixed an issue with delayed X KeyRelease events (bsc#1100453)

Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524)

Avoid use of hard-coded sesman port. (bsc#1060644)

Backport upstream commit 5575197, sesman should stop setting LANG and let initialization scripts take care of it (bsc#1023988).

Backport upstream patches for 32bpp support (bsc#1022098).

Fixed a regression connecting from Windows 10. (bsc#1090174)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xrdp fixes the following issues :

These security issues were fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch CVE-2017-16927.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes

  - Fix local denial of service CVE-2017-16927 #958 #979     (fix already in 0.9.4-2)

New features

  - Add a new log level TRACE more verbose than DEBUG #835     #944

  - SSH agent forwarding via RDP #867 #868     FreeRDP/FreeRDP#4122

  - Support horizontal wheel properly #928

Bug fixes

  - Avoid use of hard-coded sesman port #895

  - Workaround for corrupted display with Windows Server     2008 using NeutrinoRDP #869

  - Fix glitch in audio redirection by AAC #910 #936

  - Implement vsock support #930 #935 #948

  - Avoid 100% CPU usage on SSL accept #956

Other changes

  - Add US Dvorak keyboard #929

  - Suppress some misleading logs #964

  - Add Finnish keyboard #972

  - Add more user-friendlier description about Xorg config     #974

  - Renew pulseaudio document #984 #985

  - Lots of cleanups and refactoring

Known issues

  - Audio redirection by MP3 codec doesn't sound with some     client, use AAC instead #965

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xrdp reports :

The scp_v0s_accept function in the session manager uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

ID	Name	Product	Family	Severity
183700	Ubuntu 16.04 ESM : xrdp vulnerabilities (USN-4815-1)	Nessus	Ubuntu Local Security Checks	high
126771	SUSE SLES12 Security Update : xrdp (SUSE-SU-2019:1860-1)	Nessus	SuSE Local Security Checks	critical
126738	SUSE SLED12 / SLES12 Security Update : xrdp (SUSE-SU-2019:1847-1)	Nessus	SuSE Local Security Checks	critical
105963	Fedora 27 : 1:xrdp (2017-b891f919c5)	Nessus	Fedora Local Security Checks	high
105829	Fedora 27 : 1:xrdp (2017-1c73749b66)	Nessus	Fedora Local Security Checks	high
105707	Fedora 26 : 1:xrdp (2017-4603342f9a)	Nessus	Fedora Local Security Checks	high
105138	Fedora 26 : 1:xrdp (2017-f67f3ffb5d)	Nessus	Fedora Local Security Checks	high
105126	Fedora 25 : 1:xrdp (2017-1fb805bfc2)	Nessus	Fedora Local Security Checks	high
104945	FreeBSD : xrdp -- local user can cause a denial of service (a66f9be2-d519-11e7-9866-c85b763a2f96)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-16927

high

Tenable Plugins

high

critical

critical

high

high

high

high

high

high