FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3654 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a malicious server might trigger out of bound writes in a connected client.
    Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0`     width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the     memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not     allocated) region. This issue has been patched in FreeRDP 2.4.1. (CVE-2021-41160)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

  - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using     `/parallel` command line switch might read uninitialized data and send it to the server the client is     currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1     where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel`     command line switch) as a workaround. (CVE-2022-39282)

  - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the     `/video` command line switch might read uninitialized data, decode it as audio/video and display the     result. FreeRDP based server implementations are not affected. This issue has been patched in version     2.8.1. If you cannot upgrade do not use the `/video` switch. (CVE-2022-39283)

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch. (CVE-2022-39318)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
    (CVE-2022-39319)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch. (CVE-2022-39347)

  - FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`. (CVE-2022-41877)

  - An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde     InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to     privilege escalation. (CVE-2023-39283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-24 (FreeRDP: Multiple Vulnerabilities)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input     data. A malicious gateway might allow client memory to be written out of bounds. This issue has been     resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections     if possible or use a direct connection without a gateway. (CVE-2021-41159)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a malicious server might trigger out of bound writes in a connected client.
    Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0`     width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the     memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not     allocated) region. This issue has been patched in FreeRDP 2.4.1. (CVE-2021-41160)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

  - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using     `/parallel` command line switch might read uninitialized data and send it to the server the client is     currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1     where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel`     command line switch) as a workaround. (CVE-2022-39282)

  - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the     `/video` command line switch might read uninitialized data, decode it as audio/video and display the     result. FreeRDP based server implementations are not affected. This issue has been patched in version     2.8.1. If you cannot upgrade do not use the `/video` switch. (CVE-2022-39283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2352-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2353-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2354-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN     Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This     issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is     patched in FreeRDP 2.7.0. There are currently no known workarounds. (CVE-2022-24882)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side     authentication against a `SAM` file might be successful for invalid credentials if the server has     configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations     using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this     issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path     configured is valid and the application has file handles left. (CVE-2022-24883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5461-1 advisory.

    It was discovered that FreeRDP incorrectly handled empty password values. A remote attacker could use this     issue to bypass server authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and     Ubuntu 21.10. (CVE-2022-24882)

    It was discovered that FreeRDP incorrectly handled server configurations with an invalid SAM file path. A     remote attacker could use this issue to bypass server authentication. (CVE-2022-24883)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185962	Debian DLA-3654-1 : freerdp2 - LTS security update	Nessus	Debian Local Security Checks	critical
166721	GLSA-202210-24 : FreeRDP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
163017	SUSE SLED12 / SLES12 Security Update : freerdp (SUSE-SU-2022:2352-1)	Nessus	SuSE Local Security Checks	critical
162998	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2022:2353-1)	Nessus	SuSE Local Security Checks	critical
162997	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2022:2354-1)	Nessus	SuSE Local Security Checks	critical
162454	EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2022-1927)	Nessus	Huawei Local Security Checks	critical
161908	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : FreeRDP vulnerabilities (USN-5461-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2022-24883

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical