FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.

The remote host is affected by the vulnerability described in GLSA-202210-24 (FreeRDP: Multiple Vulnerabilities)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input     data. A malicious gateway might allow client memory to be written out of bounds. This issue has been     resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections     if possible or use a direct connection without a gateway. (CVE-2021-41159)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a malicious server might trigger out of bound writes in a connected client.
    Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0`     width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the     memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not     allocated) region. This issue has been patched in FreeRDP 2.4.1. (CVE-2021-41160)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

  - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using     `/parallel` command line switch might read uninitialized data and send it to the server the client is     currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1     where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel`     command line switch) as a workaround. (CVE-2022-39282)

  - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the     `/video` command line switch might read uninitialized data, decode it as audio/video and display the     result. FreeRDP based server implementations are not affected. This issue has been patched in version     2.8.1. If you cannot upgrade do not use the `/video` switch. (CVE-2022-39283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2352-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2353-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2354-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5461-1 advisory.

    It was discovered that FreeRDP incorrectly handled empty password values. A remote attacker could use this     issue to bypass server authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and     Ubuntu 21.10. (CVE-2022-24882)

    It was discovered that FreeRDP incorrectly handled server configurations with an invalid SAM file path. A     remote attacker could use this issue to bypass server authentication. (CVE-2022-24883)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
166721	GLSA-202210-24 : FreeRDP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
163017	SUSE SLED12 / SLES12 Security Update : freerdp (SUSE-SU-2022:2352-1)	Nessus	SuSE Local Security Checks	critical
162998	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2022:2353-1)	Nessus	SuSE Local Security Checks	critical
162997	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2022:2354-1)	Nessus	SuSE Local Security Checks	critical
161908	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : FreeRDP vulnerabilities (USN-5461-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2022-24882

high

Tenable Plugins

critical

critical

critical

critical

critical