xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow     leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to     locally access a sesman server to execute code as root. This vulnerability has been patched in version     0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds. (CVE-2022-23613)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow
    leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to
    locally access a sesman server to execute code as root. This vulnerability has been patched in version
    0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds. (CVE-2022-23613)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6474-1 advisory.

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483, CVE-2023-42822)

    It was discovered that xrdp improperly handled session establishment errors. An attacker could potentially     use this issue to bypass the OS-level session restrictions by PAM. (CVE-2023-40184)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute     arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-23468)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23477,     CVE-2022-23493)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute     arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23478)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fc2a9541-8893-11ec-9d01-80ee73419af3 advisory.

  - xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow     leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to     locally access a sesman server to execute code as root. This vulnerability has been patched in version     0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds. (CVE-2022-23613)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250813	Linux Distros Unpatched Vulnerability : CVE-2022-23613	Nessus	Misc.	high
427029	Alpine: multiple xrdp packages: security update to 0.9.18.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427029	Alpine: multiple xrdp packages: security update to 0.9.18.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
185416	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xrdp vulnerabilities (USN-6474-1)	Nessus	Ubuntu Local Security Checks	critical
157413	FreeBSD : xrdp -- privilege escalation (fc2a9541-8893-11ec-9d01-80ee73419af3)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2022-23613

high

Tenable Plugins

high

high

high

critical

high