SUSE-SU-2019:1860-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2019:1860-1

Related

Published

2019-07-16T13:30:46Z

Modified

2019-07-16T13:30:46Z

Summary

Security update for xrdp

Details

This update for xrdp fixes the following issues:

Security issues fixed:

CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman${username}passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567).
CVE-2017-16927: The scpv0saccept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591).
CVE-2017-6967: Fixed call of the PAM function authstartsession(). This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912).

Other issues addressed:

The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506)
Fixed an issue with delayed X KeyRelease events (bsc#1100453)
Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524)
Avoid use of hard-coded sesman port. (bsc#1060644)
Backport upstream commit 5575197, sesman should stop setting LANG and let initialization scripts take care of it (bsc#1023988).
Backport upstream patches for 32bpp support (bsc#1022098).
Fixed a regression connecting from Windows 10. (bsc#1090174)

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.0~git.1456906198.f422461-16.9.3

{
    "binaries": [
        {
            "xrdp": "0.9.0~git.1456906198.f422461-16.9.3"
        }
    ]
}

Name: xrdp
Purl: pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.0~git.1456906198.f422461-16.9.3

{
    "binaries": [
        {
            "xrdp": "0.9.0~git.1456906198.f422461-16.9.3"
        }
    ]
}

Name: xrdp
Purl: pkg:rpm/suse/xrdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.0~git.1456906198.f422461-16.9.3

{
    "binaries": [
        {
            "xrdp": "0.9.0~git.1456906198.f422461-16.9.3"
        }
    ]
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.0~git.1456906198.f422461-16.9.3

{
    "binaries": [
        {
            "xrdp": "0.9.0~git.1456906198.f422461-16.9.3"
        }
    ]
}