SUSE update for xrdp



Published: 2023-02-10
Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2022-23468
CVE-2022-23478
CVE-2022-23479
CVE-2022-23480
CVE-2022-23481
CVE-2022-23482
CVE-2022-23483
CVE-2022-23484
CVE-2022-23493
CWE-ID CWE-119
CWE-787
CWE-125
CWE-190
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Linux Enterprise Server
Operating systems & Components / Operating system

xrdp-debugsource
Operating systems & Components / Operating system package or component

xrdp-debuginfo
Operating systems & Components / Operating system package or component

xrdp
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU70108

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23468

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to a boundary error in xrdp_login_wnd_create() function. A remote attacker can trigger memory corruption and compromise the target system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU70099

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23478

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in xrdp_mm_trans_process_drdynvc_channel_open() function. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU70105

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23479

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in xrdp_mm_chan_data_in() function. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU70106

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23480

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in devredir_proc_client_devlist_announce_req() function. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU70102

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23481

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in xrdp_caps_process_confirm_active() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU70100

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23482

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in xrdp_sec_process_mcs_data_CS_CORE() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU70103

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23483

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in libxrdp_send_to_channel() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Integer overflow

EUVDB-ID: #VU70104

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23484

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to integer overflow in xrdp_mm_process_rail_update_window_text() function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service (DoS) attack.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU70101

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23493

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary condition in xrdp_mm_trans_process_drdynvc_channel_close() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system, or perform a denial of service (DoS) attack.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 12-SP5

xrdp-debugsource: before 0.9.10-3.8.1

xrdp-debuginfo: before 0.9.10-3.8.1

xrdp: before 0.9.10-3.8.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###