Detections
Analytics

Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : FreeRDP vulnerabilities (USN-6401-1)

critical Nessus Plugin ID 182520

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6401-1 advisory.

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39350)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39353)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out- Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.
 There are no known workarounds for this vulnerability. (CVE-2023-39354)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40181)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40186)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out- Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40188)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. (CVE-2023-40567)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. (CVE-2023-40569)

 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
 In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40589)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-6401-1

Plugin Details

Severity: Critical

ID: 182520

File Name: ubuntu_USN-6401-1.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/4/2023

Updated: 10/13/2023

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-40569

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:18.04:-:esm, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:23.04, p-cpe:/a:canonical:ubuntu_linux:freerdp2-dev, p-cpe:/a:canonical:ubuntu_linux:freerdp2-shadow-x11, p-cpe:/a:canonical:ubuntu_linux:freerdp2-wayland, p-cpe:/a:canonical:ubuntu_linux:freerdp2-x11, p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client2-2, p-cpe:/a:canonical:ubuntu_linux:libfreerdp-server2-2, p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow-subsystem2-2, p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow2-2, p-cpe:/a:canonical:ubuntu_linux:libfreerdp2-2, p-cpe:/a:canonical:ubuntu_linux:libuwac0-0, p-cpe:/a:canonical:ubuntu_linux:libuwac0-dev, p-cpe:/a:canonical:ubuntu_linux:libwinpr-tools2-2, p-cpe:/a:canonical:ubuntu_linux:libwinpr2-2, p-cpe:/a:canonical:ubuntu_linux:libwinpr2-dev, p-cpe:/a:canonical:ubuntu_linux:winpr-utils

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/4/2023

Vulnerability Publication Date: 8/31/2023

Reference Information

CVE: CVE-2023-39350, CVE-2023-39351, CVE-2023-39353, CVE-2023-39354, CVE-2023-40181, CVE-2023-40186, CVE-2023-40188, CVE-2023-40567, CVE-2023-40569, CVE-2023-40589

USN: 6401-1