xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4815-1 advisory.

  - The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses     an untrusted integer as a write length, which allows local users to cause a denial of service (buffer     overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
    (CVE-2017-16927)

  - xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session     modules not being properly initialized, with a potential consequence of incorrect configurations or     elevation of privileges, aka a pam_limits.so bypass. (CVE-2017-6967)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xrdp provides the following fix :

CVE-2020-4044: xrdp-sesman can be crashed remotely over port 3350 (bsc#1173580).

Fixed an issue where xrdp-sesman could not restart (bsc#1155952).

Fixed an issue where xrdp could not start due to an error in the service file use absolute path in ExecStart (bsc#1155789).

Fixed a PAM error after 2nd xrdp session after logout (bsc#1153471).

Fixed a crash in xrdp-sesman, caused by terminating and reconnecting an xrdp session (bsc#1152711).

Fixed a failure in RDP session recovery (bsc#1150584).

Fixed a process leak (bsc#1144379).

Let systemd handle the daemons, fixing daemon start failures.
(bsc#1138954, bsc#1144327)

Don't try to create .vnc directory if it already exists. (bsc#1157860)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xrdp fixes the following issues :

Security issues fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

Other issues addressed: The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506)

Fixed an issue with delayed X KeyRelease events (bsc#1100453)

Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524)

Avoid use of hard-coded sesman port. (bsc#1060644)

Backport upstream commit 5575197, sesman should stop setting LANG and let initialization scripts take care of it (bsc#1023988).

Backport upstream patches for 32bpp support (bsc#1022098).

Fixed a regression connecting from Windows 10. (bsc#1090174)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xrdp fixes the following issues :

These security issues were fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream version of xorgxrdp and xrdp :

New features in xrdp :

  - RemoteFX codec support is now enabled by default.

  - Bitmap updates support is now enabled by default.

  - TLS ciphers suites and version is now logged.

  - Connected computer name is now logged.

  - Switched to Xorg (xorgxrdp) as the default backend now.

  - Miscellaneous RemoteFX codec mode improvements.

  - Socket directory is configurable at the compile time.

Bugfixes in xrdp :

  - Parallels client for MacOS / iOS can now connect (audio     redirection must be disabled on client or xrdp server     though).

  - MS RDP client for iOS can now connect using TLS security     layer.

  - MS RDP client for Android can now connect to xrdp.

  - Large resolutions (4K) can be used with RemoteFX     graphics.

  - Multiple RemoteApps can be opened throguh NeutrinoRDP     proxy.

  - tls_ciphers in xrdp.ini is not limited to 63 chars     anymore, it's variable-length.

  - Fixed an issue where tls_ciphers were ignored and rdp     security layer could be used instead.

  - Kill disconnected sessions feature is working with Xorg     (xorgxrdp) backend.

  - Miscellaneous code cleanup and memory issues fixes.

Rebuild of xrdp requiring both xorgxrdp and tigervnc-minimal. VNC is still the default.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that xrdp, a Remote Desktop Protocol (RDP) server, calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.

For Debian 7 'Wheezy', these problems have been fixed in version 0.5.0-2+deb7u1.

We recommend that you upgrade your xrdp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183700	Ubuntu 16.04 ESM : xrdp vulnerabilities (USN-4815-1)	Nessus	Ubuntu Local Security Checks	high
138758	SUSE SLES12 Security Update : xrdp (SUSE-SU-2020:1943-1)	Nessus	SuSE Local Security Checks	high
126771	SUSE SLES12 Security Update : xrdp (SUSE-SU-2019:1860-1)	Nessus	SuSE Local Security Checks	critical
126738	SUSE SLED12 / SLES12 Security Update : xrdp (SUSE-SU-2019:1847-1)	Nessus	SuSE Local Security Checks	critical
101753	Fedora 26 : 1:xrdp / xorgxrdp (2017-fc634e7ee7)	Nessus	Fedora Local Security Checks	high
99413	Fedora 24 : 1:xrdp / xorgxrdp (2017-8eac23007d)	Nessus	Fedora Local Security Checks	high
99411	Fedora 25 : 1:xrdp / xorgxrdp (2017-7bd002b77c)	Nessus	Fedora Local Security Checks	high
99000	Debian DLA-872-1 : xrdp security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-6967

high

Tenable Plugins

high

high

critical

critical

high

high

high

high