Ubuntu update for xrdp



Published: 2023-11-09
Risk High
Patch available YES
Number of vulnerabilities 13
CVE-ID CVE-2022-23479
CVE-2022-23481
CVE-2022-23483
CVE-2023-42822
CVE-2023-40184
CVE-2022-23468
CVE-2022-23480
CVE-2022-23482
CVE-2022-23484
CVE-2022-23477
CVE-2022-23493
CVE-2022-23478
CVE-2022-23613
CWE-ID CWE-119
CWE-125
CWE-254
CWE-190
CWE-787
CWE-191
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Ubuntu
Operating systems & Components / Operating system

xrdp (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 13 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU70105

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23479

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in xrdp_mm_chan_data_in() function. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU70102

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23481

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in xrdp_caps_process_confirm_active() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU70103

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23483

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in libxrdp_send_to_channel() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU81308

Risk: Medium

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42822

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in xrdp_painter.c when accessing the font glyphs. A remote user can trigger an out-of-bounds read error and read contents of memory on the system.

Successful exploitation of the vulnerability may lead to system compromise.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security features bypass

EUVDB-ID: #VU80197

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-40184

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper handling of session restrictions inside the xrdp-sesman. A remote user can bypass session restrictions, such as max concurrent sessions per user enforced by PAM.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU70108

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23468

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to a boundary error in xrdp_login_wnd_create() function. A remote attacker can trigger memory corruption and compromise the target system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU70106

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23480

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in devredir_proc_client_devlist_announce_req() function. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU70100

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23482

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in xrdp_sec_process_mcs_data_CS_CORE() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU70104

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23484

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to integer overflow in xrdp_mm_process_rail_update_window_text() function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service (DoS) attack.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU70107

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23477

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in audin_send_open() function. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU70101

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23493

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary condition in xrdp_mm_trans_process_drdynvc_channel_close() function. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system, or perform a denial of service (DoS) attack.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds write

EUVDB-ID: #VU70099

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23478

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in xrdp_mm_trans_process_drdynvc_channel_open() function. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Integer underflow

EUVDB-ID: #VU60614

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23613

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow in the sesman server. A local user can send a specially crafted request to the affected application, trigger integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package xrdp to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 22.04

xrdp (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6474-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###