Detections
Analytics

Amazon Linux 2 : freerdp (ALAS-2019-1365)

medium Nessus Plugin ID 131234

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3. (CVE-2018-1000852)

Solution

Run 'yum update freerdp' to update your system.

See Also

https://alas.aws.amazon.com/AL2/ALAS-2019-1365.html

Plugin Details

Severity: Medium

ID: 131234

File Name: al2_ALAS-2019-1365.nasl

Version: 1.4

Type: local

Agent: unix

Published: 11/25/2019

Updated: 4/10/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2018-1000852

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:freerdp, p-cpe:/a:amazon:linux:freerdp-debuginfo, p-cpe:/a:amazon:linux:freerdp-devel, p-cpe:/a:amazon:linux:freerdp-libs, p-cpe:/a:amazon:linux:libwinpr, p-cpe:/a:amazon:linux:libwinpr-devel, cpe:/o:amazon:linux:2

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/19/2019

Vulnerability Publication Date: 12/20/2018

Reference Information

CVE: CVE-2018-1000852

ALAS: 2019-1365