An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.

This update for xrdp fixes the following issues :

Security issues fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

Other issues addressed: The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506)

Fixed an issue with delayed X KeyRelease events (bsc#1100453)

Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524)

Avoid use of hard-coded sesman port. (bsc#1060644)

Backport upstream commit 5575197, sesman should stop setting LANG and let initialization scripts take care of it (bsc#1023988).

Backport upstream patches for 32bpp support (bsc#1022098).

Fixed a regression connecting from Windows 10. (bsc#1090174)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xrdp fixes the following issues :

These security issues were fixed :

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).

CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).

CVE-2017-6967: Fixed call of the PAM function auth_start_session().
This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

WARNING: Please note that this update comes with a slightly different syntax of sesman.ini file, so if you edited this file by hand, you may need to look at the .rpmnew file and merge any required changes by hand.

This release also creates three files in /etc/xrdp directory if they don't already exist or are empty :

  - rsakeys.ini

  - cert.pem

  - key.pem

Also note that in Fedora, the only backend that will really work is still Xvnc for now.

New features

  - New xorgxrdp backend using existing Xorg with additional     modules

  - Improvements to X11rdp backend

  - Support for IPv6 (disabled by default)

  - Initial support for RemoteFX Codec (disabled by default)

  - Support for TLS security layer (preferred over RDP layer     if supported by the client)

  - Support for disabling deprecated SSLv3 protocol and for     selecting custom cipher suites in xrdp.ini

  - Support for bidirectional fastpath (enabled in both     directions by default)

  - Support clients that don't support drawing orders, such     as MS RDP client for Android, ChromeRDP (disabled by     default)

  - More configurable login screen

  - Support for new virtual channels :

    - rdpdr: device redirection

    - rdpsnd: audio output

    - cliprdr: clipboard

    - xrdpvr: xrdp video redirection channel (can be used       along with NeutrinoRDP client)

  - Support for disabling virtual channels globally or by     session type

  - Allow to specify the path for backends (Xorg, X11rdp,     Xvnc)

  - Added files for systemd support

  - Multi-monitor support

  - xrdp-chansrv stroes logs in ${XDG_DATA_HOME}/xrdp now

Security fixes

  - User's password could be recovered from the Xvnc     password file

  - X11 authentication was not used

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
126771	SUSE SLES12 Security Update : xrdp (SUSE-SU-2019:1860-1)	Nessus	SuSE Local Security Checks	critical
126738	SUSE SLED12 / SLES12 Security Update : xrdp (SUSE-SU-2019:1847-1)	Nessus	SuSE Local Security Checks	critical
97500	Fedora 24 : 1:xrdp (2017-05e32fe278)	Nessus	Fedora Local Security Checks	critical
97365	Fedora 25 : 1:xrdp (2017-8fffbae8af)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2013-1430

critical

Tenable Plugins

critical

critical

critical

critical