The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3370 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3370-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Dominik George     March 28, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : xrdp     Version        : 0.9.9-1+deb10u2     CVE ID         : CVE-2022-23468 CVE-2022-23478 CVE-2022-23479 CVE-2022-23483                      CVE-2022-23484 CVE-2022-23493     Debian Bug     :

    Several out of bounds memory access and buffer overflows were fixed in xrdp,     an open source project which provides a graphical login to remote machines     using Microsoft Remote Desktop Protocol (RDP)

    CVE-2022-23468

        xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
        There are no known workarounds for this issue.

    CVE-2022-23478

        xrdp < v0.9.21 contain a Out of Bound Write in         xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known         workarounds for this issue.

    CVE-2022-23479

        xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
        There are no known workarounds for this issue.

    CVE-2022-23483

        xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
        There are no known workarounds for this issue.

    CVE-2022-23484

        xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text()         function. There are no known workarounds for this issue.

    CVE-2022-23493

        xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close()         function. There are no known workarounds for this issue.

    For Debian 10 buster, these problems have been fixed in version     0.9.9-1+deb10u2.

    We recommend that you upgrade your xrdp packages.

    For the detailed security status of xrdp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xrdp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3370 : xrdp - security update

critical Nessus Plugin ID 173714

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.0 Mar 31, 2023, 4:04 AM New Plugin Feed: 202303310404