Security update for xrdp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1847-1 Final 1 1 2019-07-15T12:38:52Z current 2019-07-15T12:38:52Z 2019-07-15T12:38:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xrdp This update for xrdp fixes the following issues: These security issues were fixed: - CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567). - CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591). - CVE-2017-6967: Fixed call of the PAM function auth_start_session(). This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912). These non-security issues were fixed: - The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506) - Fixed an issue with delayed X KeyRelease events (bsc#1100453) - Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524) - Avoid use of hard-coded sesman port. (bsc#1060644) - Fixed a regression connecting from Windows 10. (bsc#1090174) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2019-1847,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2019-1847,SUSE-2019-1847,SUSE-SLE-DESKTOP-12-SP4-2019-1847,SUSE-SLE-SERVER-12-SP4-2019-1847 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/ Link for SUSE-SU-2019:1847-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005708.html E-Mail link for SUSE-SU-2019:1847-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1014524 SUSE Bug 1014524 https://bugzilla.suse.com/1015567 SUSE Bug 1015567 https://bugzilla.suse.com/1029912 SUSE Bug 1029912 https://bugzilla.suse.com/1060644 SUSE Bug 1060644 https://bugzilla.suse.com/1069591 SUSE Bug 1069591 https://bugzilla.suse.com/1090174 SUSE Bug 1090174 https://bugzilla.suse.com/1100453 SUSE Bug 1100453 https://bugzilla.suse.com/1101506 SUSE Bug 1101506 https://www.suse.com/security/cve/CVE-2013-1430/ SUSE CVE CVE-2013-1430 page https://www.suse.com/security/cve/CVE-2017-16927/ SUSE CVE CVE-2017-16927 page https://www.suse.com/security/cve/CVE-2017-6967/ SUSE CVE CVE-2017-6967 page Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 xrdp-0.9.0~git.1456906198.f422461-21.9.1 xrdp-0.9.0~git.1456906198.f422461-21.9.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production xrdp-0.9.0~git.1456906198.f422461-21.9.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production xrdp-0.9.0~git.1456906198.f422461-21.9.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 xrdp-0.9.0~git.1456906198.f422461-21.9.1 as a component of SUSE Linux Enterprise Server 12 SP4 xrdp-0.9.0~git.1456906198.f422461-21.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key. CVE-2013-1430 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Desktop 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 important 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/ https://www.suse.com/security/cve/CVE-2013-1430.html CVE-2013-1430 https://bugzilla.suse.com/1015567 SUSE Bug 1015567 https://bugzilla.suse.com/442182 SUSE Bug 442182 The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. CVE-2017-16927 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Desktop 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 important 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/ https://www.suse.com/security/cve/CVE-2017-16927.html CVE-2017-16927 https://bugzilla.suse.com/1069591 SUSE Bug 1069591 https://bugzilla.suse.com/442182 SUSE Bug 442182 xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass. CVE-2017-6967 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Desktop 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:xrdp-0.9.0~git.1456906198.f422461-21.9.1 important 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191847-1/ https://www.suse.com/security/cve/CVE-2017-6967.html CVE-2017-6967 https://bugzilla.suse.com/1029912 SUSE Bug 1029912 https://bugzilla.suse.com/442182 SUSE Bug 442182