xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6fe4046ae9 advisory.

    Release notes for xrdp v0.9.21 (2022/12/10)

    General announcements

    - Running xrdp and xrdp-sesman on separate hosts is still supported by this release, but is now     deprecated. This is not secure. A future v1.0 release will replace the TCP socket used between these     processes with a Unix Domain Socket, and then cross-host running will not be possible.

    Security fixes

    This update is recommended for all xrdp users and provides following important security fixes:

    - CVE-2022-23468
    - CVE-2022-23477
    - CVE-2022-23478
    - CVE-2022-23479
    - CVE-2022-23480
    - CVE-2022-23481
    - CVE-2022-23483
    - CVE-2022-23482
    - CVE-2022-23484
    - CVE-2022-23493

    These security issues are reported by Team BT5 (BoB 11th). We appreciate their great help with making and     reviewing patches.
    New features

    - openSuSE Tumbleweed move to /usr/lib/pam.d is now supported in the installation scripts (#2413)
    - VNC backend session now supports extra mouse buttons 6, 7 and 8 (#2426)

    Bug fixes

    - Passwords are no longer left on the heap in sesman (#1599 #2439)
    - Set permissions on pcsc socket dir to owner only (#2454 #2460)

    Internal changes

    - CI updates to cope with github upgrades (#2395)

    Changes for packagers or developers

    Nothing this time.

    Known issues

    - On-the-fly resolution change requires the Microsoft Store version of Remote Desktop client but sometimes     crashes on connect (#1869)
    - xrdp's login dialog is not relocated at the center of the new resolution after on-the-fly resolution     change happens (#1867)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6474-1 advisory.

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483, CVE-2023-42822)

    It was discovered that xrdp improperly handled session establishment errors. An attacker could potentially     use this issue to bypass the OS-level session restrictions by PAM. (CVE-2023-40184)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute     arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-23468)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23477,     CVE-2022-23493)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute     arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23478)

    It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to     out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive     information. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5502 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0151-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-08d2138578 advisory.

    Release notes for xrdp v0.9.21 (2022/12/10)

    General announcements

    - Running xrdp and xrdp-sesman on separate hosts is still supported by this release, but is now     deprecated. This is not secure. A future v1.0 release will replace the TCP socket used between these     processes with a Unix Domain Socket, and then cross-host running will not be possible.

    Security fixes

    This update is recommended for all xrdp users and provides following important security fixes:

    - CVE-2022-23468
    - CVE-2022-23477
    - CVE-2022-23478
    - CVE-2022-23479
    - CVE-2022-23480
    - CVE-2022-23481
    - CVE-2022-23483
    - CVE-2022-23482
    - CVE-2022-23484
    - CVE-2022-23493

    These security issues are reported by Team BT5 (BoB 11th). We appreciate their great help with making and     reviewing patches.
    New features

    - openSuSE Tumbleweed move to /usr/lib/pam.d is now supported in the installation scripts (#2413)
    - VNC backend session now supports extra mouse buttons 6, 7 and 8 (#2426)

    Bug fixes

    - Passwords are no longer left on the heap in sesman (#1599 #2439)
    - Set permissions on pcsc socket dir to owner only (#2454 #2460)

    Internal changes

    - CI updates to cope with github upgrades (#2395)

    Changes for packagers or developers

    Nothing this time.

    Known issues

    - On-the-fly resolution change requires the Microsoft Store version of Remote Desktop client but sometimes     crashes on connect (#1869)
    - xrdp's login dialog is not relocated at the center of the new resolution after on-the-fly resolution     change happens (#1867)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ba94433c-7890-11ed-859e-1c61b4739ac9 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211003	Fedora 37 : xrdp (2022-6fe4046ae9)	Nessus	Fedora Local Security Checks	critical
185416	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xrdp vulnerabilities (USN-6474-1)	Nessus	Ubuntu Local Security Checks	critical
181564	Debian DSA-5502-1 : xrdp - security update	Nessus	Debian Local Security Checks	critical
170673	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xrdp (SUSE-SU-2023:0151-1)	Nessus	SuSE Local Security Checks	critical
169266	Fedora 36 : xrdp (2022-08d2138578)	Nessus	Fedora Local Security Checks	critical
168620	FreeBSD : xrdp -- multiple vulnerabilities (ba94433c-7890-11ed-859e-1c61b4739ac9)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2022-23477

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical