リモートの Redhat Enterprise Linux 9 ホストにインストールされているパッケージは、RHSA-2023: 2326 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。「/ parallel」コマンドラインスイッチを使用する unix システム上の FreeRDP ベースのクライアントは、初期化されていないデータを読み取り、クライアントが現在接続しているサーバーに送信する可能性があります。FreeRDP ベースのサーバーの実装は影響を受けません。この問題にパッチが適用されている 2.8.1にアップグレードしてください。アップグレードできない場合は、回避策としてパラレルポートリダイレクト (「/parallel」コマンドラインスイッチ) を使用しないでください。(CVE-2022-39282)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。すべての FreeRDP ベースのクライアントは、「/video」コマンドラインスイッチを使用するとき、初期化されていないデータを読み取り、オーディオ / ビデオとしてデコードし、結果を表示する可能性があります。FreeRDP ベースのサーバーの実装は影響を受けません。この問題には、バージョン 2.8.1でパッチが適用されています。アップグレードできない場合は、「/video」スイッチを使用しないでください。(CVE-2022-39283)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンでは、FreeRDP の ZGFX デコーダーコンポーネントに領域外読み取りがあります。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、それをデコードしようと試みることで、クラッシュを引き起こす可能性があります。この問題は、2.9.0 リリースで対処されています。ユーザーにアップグレードすることを推奨します。(CVE-2022-39316)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP に、ZGFX デコーダーの入力オフセットインデックスの範囲チェックがありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、それをデコードしようと試みる可能性があります。この問題は、バージョン 2.9.0で対処されています。この問題についての既知の回避策はありません。(CVE-2022-39317)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「urbdrc」チャネルに入力検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、ゼロ除算でクラッシュする可能性があります。この問題は、バージョン 2.9.0で対処されています。全ユーザーにアップグレードすることを推奨します。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。(CVE-2022-39318)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「urbdrc」チャネルに入力長検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。
    (CVE-2022-39319)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP は、幅が狭すぎる型で整数の追加を試行するため、書き込まれたデータを保持するバッファが小さすぎます。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。(CVE-2022-39320)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。FreeRDP の影響を受けるバージョンに、「drive」チャネルのパス正規化およびベースパスチェックがありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、共有ディレクトリ外のファイルを読み取らせる可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/drive」、「/drives」または「+home-drive」リダイレクトスイッチを使用しないでください。(CVE-2022-39347)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「drive」チャネルに入力長検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、ドライブリダイレクトチャネルのコマンドラインオプション「/drive」、「/drives」または「+home-drive」を使用しないでください。(CVE-2022-41877)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートのAlmaLinux 9ホストには、ALSA-2023:2326アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。「/ parallel」コマンドラインスイッチを使用する unix システム上の FreeRDP ベースのクライアントは、初期化されていないデータを読み取り、クライアントが現在接続しているサーバーに送信する可能性があります。FreeRDP ベースのサーバーの実装は影響を受けません。この問題にパッチが適用されている 2.8.1にアップグレードしてください。アップグレードできない場合は、回避策としてパラレルポートリダイレクト (「/parallel」コマンドラインスイッチ) を使用しないでください。(CVE-2022-39282)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。すべての FreeRDP ベースのクライアントは、「/video」コマンドラインスイッチを使用するとき、初期化されていないデータを読み取り、オーディオ / ビデオとしてデコードし、結果を表示する可能性があります。FreeRDP ベースのサーバーの実装は影響を受けません。この問題には、バージョン 2.8.1でパッチが適用されています。アップグレードできない場合は、「/video」スイッチを使用しないでください。(CVE-2022-39283)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンでは、FreeRDP の ZGFX デコーダーコンポーネントに領域外読み取りがあります。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、それをデコードしようと試みることで、クラッシュを引き起こす可能性があります。この問題は、2.9.0 リリースで対処されています。ユーザーにアップグレードすることを推奨します。(CVE-2022-39316)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP に、ZGFX デコーダーの入力オフセットインデックスの範囲チェックがありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、それをデコードしようと試みる可能性があります。この問題は、バージョン 2.9.0で対処されています。この問題についての既知の回避策はありません。(CVE-2022-39317)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「urbdrc」チャネルに入力検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、ゼロ除算でクラッシュする可能性があります。この問題は、バージョン 2.9.0で対処されています。全ユーザーにアップグレードすることを推奨します。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。(CVE-2022-39318)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「urbdrc」チャネルに入力長検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。
    (CVE-2022-39319)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP は、幅が狭すぎる型で整数の追加を試行するため、書き込まれたデータを保持するバッファが小さすぎます。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/usb」リダイレクトスイッチを使用しないでください。(CVE-2022-39320)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。FreeRDP の影響を受けるバージョンに、「drive」チャネルのパス正規化およびベースパスチェックがありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、共有ディレクトリ外のファイルを読み取らせる可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、「/drive」、「/drives」または「+home-drive」リダイレクトスイッチを使用しないでください。(CVE-2022-39347)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンの FreeRDP の「drive」チャネルに入力長検証がありません。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、サーバーに送り返す可能性があります。この問題はバージョン 2.9.0 で対処されており、すべてのユーザーはアップグレードすることが推奨されます。アップグレードできないユーザーは、ドライブリダイレクトチャネルのコマンドラインオプション「/drive」、「/drives」または「+home-drive」を使用しないでください。(CVE-2022-41877)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートの CentOS Linux 9 ホストに、freerdp-2.4.1-5.el9 ビルド変更ログに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - パラレルドライバーの長さチェックを修正します (#2136152) (CVE-2022-39282)

  - ビデオチャネルで欠落している長さチェックを追加します (#2136154) (CVE-2022-39283)

  - FreeRDP は、無料のリモートデスクトッププロトコルライブラリおよびクライアントです。影響を受けるバージョンでは、FreeRDP の ZGFX デコーダーコンポーネントに領域外読み取りがあります。悪意のあるサーバーが FreeRDP ベースのクライアントを騙して、境界外のデータを読み取らせ、それをデコードしようと試みることで、クラッシュを引き起こす可能性があります。この問題は、2.9.0 リリースで対処されています。ユーザーにアップグレードすることを推奨します。(CVE-2022-39316)

  - zgfx で欠落している長さチェックを追加します (#2145140) (CVE-2022-39317)

  - urbdrc チャネルのゼロ除算を修正します (#2145140) (CVE-2022-39318)

  - urbdrc チャネルで欠落している長さチェックを追加します (#2145140) (CVE-2022-39319)

  - urb_create_iocompletion が size_t を使用するようにします (#2145140) (CVE-2022-39320)

  - ドライブチャネルのパス検証を修正します (#2145140) (CVE-2022-39347)

  - ドライブチャネルで欠落している長さチェックを追加します (#2145140) (CVE-2022-41877)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote host is affected by the vulnerability described in GLSA-202401-16 (FreeRDP: Multiple Vulnerabilities)

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
    (CVE-2022-39319)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch. (CVE-2022-39320)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with     default compilation flags). When an insufficient blockLen is provided, and proper length validation is not     performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-39350)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be     triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and     `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice     this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39352)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the     `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and     `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will     cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39353)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-     Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of     sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a     crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-39354)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing     `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is 0, `context->planesBuffer` will be     freed. However, without updating `context->planesBuffer`, this leads to a Use-After-Free exploit vector.
    In most environments this should only result in a crash. This issue has been addressed in version     3.0.0-beta3 and users of the beta 3.x releases are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2023-39355)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a missing offset validation may lead to an Out Of Bound Read in the function     `gdi_multi_opaque_rect`. In particular there is no code to validate if the value     `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles     without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash.
    This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are     no known workarounds for this vulnerability. (CVE-2023-39356)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the     `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the     transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and     3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40181)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the     `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not     affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and     3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40186)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the     `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0,     `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which     leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of     the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-40187)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-     Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data     of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-40188)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in     which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This     issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no     known workarounds for this vulnerability. (CVE-2023-40567)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This     issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been     addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds     for this vulnerability. (CVE-2023-40569)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is     likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been     addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this     issue. (CVE-2023-40574)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX`     function. This issue is likely down to insufficient data for the `pSrc` variable and results in crashes.
    This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-40575)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `RleDecompress` function. This Out-Of-Bounds     Read occurs because FreeRDP processes the `pbSrcBuffer` variable without checking if it contains data of     sufficient length. Insufficient data in the `pbSrcBuffer` variable may cause errors or crashes. This issue     has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds     for this issue. (CVE-2023-40576)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted     input into this function can trigger the overflow which has only been shown to cause a crash. This issue     has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-40589)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2851 advisory.

    - CVE-2022-39282: Fix length checks in parallel driver (#2136151)
    - CVE-2022-39283: Add missing length check in video channel (#2136153)
    - CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145139)
    - CVE-2022-39318: Fix division by zero in urbdrc channel (#2145139)
    - CVE-2022-39319: Add missing length checks in urbdrc channel (#2145139)
    - CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145139)
    - CVE-2022-39347: Fix path validation in drive channel (#2145139)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1f0421b1-8398-11ed-973d-002b67dfc673 advisory.

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
    (CVE-2022-39319)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch. (CVE-2022-39320)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using     `/parallel` command line switch might read uninitialized data and send it to the server the client is     currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1     where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel`     command line switch) as a workaround. (CVE-2022-39282)

  - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the     `/video` command line switch might read uninitialized data, decode it as audio/video and display the     result. FreeRDP based server implementations are not affected. This issue has been patched in version     2.8.1. If you cannot upgrade do not use the `/video` switch. (CVE-2022-39283)

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of freerdp installed on the remote host is prior to 2.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-321-01 advisory.

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
    (CVE-2022-39319)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch. (CVE-2022-39320)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-076b1c9978 advisory.

    Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319, CVE-2022-39320,     CVE-2022-41877 and CVE-2022-39347).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0399-1 advisory.

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch. (CVE-2022-39320)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2851 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)

    * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)

    * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)

    * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)

    * freerdp: division by zero in urbdrc channel (CVE-2022-39318)

    * freerdp: missing length validation in urbdrc channel (CVE-2022-39319)

    * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)

    * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)

    * freerdp: missing input length validation in `drive` channel (CVE-2022-41877)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2851 advisory.

  - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using     `/parallel` command line switch might read uninitialized data and send it to the server the client is     currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1     where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel`     command line switch) as a workaround. (CVE-2022-39282)

  - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the     `/video` command line switch might read uninitialized data, decode it as audio/video and display the     result. FreeRDP based server implementations are not affected. This issue has been patched in version     2.8.1. If you cannot upgrade do not use the `/video` switch. (CVE-2022-39283)

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue. (CVE-2022-39317)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
    (CVE-2022-39319)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch. (CVE-2022-39320)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175472	RHEL 9 : freerdp (RHSA-2023: 2326)	Nessus	Red Hat Local Security Checks	5/13/2023	11/8/2024	high
175639	AlmaLinux 9freerdpALSA-2023:2326	Nessus	Alma Linux Local Security Checks	5/14/2023	5/14/2023	high
193924	CentOS 9 : freerdp-2.4.1-5.el9	Nessus	CentOS Local Security Checks	4/26/2024	4/26/2024	high
187999	GLSA-202401-16 : FreeRDP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	1/12/2024	1/12/2024	critical
176314	Oracle Linux 8 : freerdp (ELSA-2023-2851)	Nessus	Oracle Linux Local Security Checks	5/24/2023	10/22/2024	high
169295	FreeBSD : freerdp -- multiple vulnerabilities (1f0421b1-8398-11ed-973d-002b67dfc673)	Nessus	FreeBSD Local Security Checks	12/24/2022	12/24/2022	medium
171166	EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2023-1313)	Nessus	Huawei Local Security Checks	2/8/2023	2/8/2023	high
167881	Slackware Linux 15.0 / current freerdp Multiple Vulnerabilities (SSA:2022-321-01)	Nessus	Slackware Local Security Checks	11/18/2022	3/22/2023	medium
211437	Fedora 37 : freerdp (2022-076b1c9978)	Nessus	Fedora Local Security Checks	11/15/2024	11/15/2024	medium
171486	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : freerdp (SUSE-SU-2023:0399-1)	Nessus	SuSE Local Security Checks	2/15/2023	7/14/2023	medium
175865	RHEL 8 : freerdp (RHSA-2023:2851)	Nessus	Red Hat Local Security Checks	5/16/2023	11/7/2024	high
176173	AlmaLinux 8 : freerdp (ALSA-2023:2851)	Nessus	Alma Linux Local Security Checks	5/20/2023	5/20/2023	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

medium

high

medium

medium

medium

high

high