SUSE-SU-2019:1847-1
- Source
- https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1847-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2019:1847-1
- Related
- Published
- 2019-07-15T12:38:52Z
- Modified
- 2019-07-15T12:38:52Z
- Summary
- Security update for xrdp
- Details
-
This update for xrdp fixes the following issues:
These security issues were fixed:
- CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman${username}passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).
- CVE-2017-16927: The scpv0saccept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).
- CVE-2017-6967: Fixed call of the PAM function authstartsession(). This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).
These non-security issues were fixed:
- The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506)
- Fixed an issue with delayed X KeyRelease events (bsc#1100453)
- Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524)
- Avoid use of hard-coded sesman port. (bsc#1060644)
- Fixed a regression connecting from Windows 10. (bsc#1090174)
- References
-
- https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/
- https://bugzilla.suse.com/1014524
- https://bugzilla.suse.com/1015567
- https://bugzilla.suse.com/1029912
- https://bugzilla.suse.com/1060644
- https://bugzilla.suse.com/1069591
- https://bugzilla.suse.com/1090174
- https://bugzilla.suse.com/1100453
- https://bugzilla.suse.com/1101506
- https://www.suse.com/security/cve/CVE-2013-1430
- https://www.suse.com/security/cve/CVE-2017-16927
- https://www.suse.com/security/cve/CVE-2017-6967
Affected packages
SUSE:Linux Enterprise Desktop 12 SP4 / xrdp
Package
- Name
- xrdp
- Purl
- pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4
SUSE:Linux Enterprise Server 12 SP4 / xrdp
Package
- Name
- xrdp
- Purl
- pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4