Security update for xrdp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1860-1 Final 1 1 2019-07-16T13:30:46Z current 2019-07-16T13:30:46Z 2019-07-16T13:30:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xrdp This update for xrdp fixes the following issues: Security issues fixed: - CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key (bsc#1015567). - CVE-2017-16927: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through used an untrusted integer as a write length, which could lead to a local denial of service (bsc#1069591). - CVE-2017-6967: Fixed call of the PAM function auth_start_session(). This lead to to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass (bsc#1029912). Other issues addressed: - The KillDisconnected option for TigerVNC Xvnc sessions is now supported (bsc#1101506) - Fixed an issue with delayed X KeyRelease events (bsc#1100453) - Force xrdp-sesman.service to start after xrdp.service. (bsc#1014524) - Avoid use of hard-coded sesman port. (bsc#1060644) - Backport upstream commit 5575197, sesman should stop setting LANG and let initialization scripts take care of it (bsc#1023988). - Backport upstream patches for 32bpp support (bsc#1022098). - Fixed a regression connecting from Windows 10. (bsc#1090174) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1860,SUSE-OpenStack-Cloud-7-2019-1860,SUSE-SLE-SAP-12-SP2-2019-1860,SUSE-SLE-SERVER-12-SP2-2019-1860,SUSE-Storage-4-2019-1860 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191860-1/ Link for SUSE-SU-2019:1860-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005721.html E-Mail link for SUSE-SU-2019:1860-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1014524 SUSE Bug 1014524 https://bugzilla.suse.com/1015567 SUSE Bug 1015567 https://bugzilla.suse.com/1022098 SUSE Bug 1022098 https://bugzilla.suse.com/1023988 SUSE Bug 1023988 https://bugzilla.suse.com/1029912 SUSE Bug 1029912 https://bugzilla.suse.com/1060644 SUSE Bug 1060644 https://bugzilla.suse.com/1069591 SUSE Bug 1069591 https://bugzilla.suse.com/1090174 SUSE Bug 1090174 https://bugzilla.suse.com/1100453 SUSE Bug 1100453 https://bugzilla.suse.com/1101506 SUSE Bug 1101506 https://www.suse.com/security/cve/CVE-2013-1430/ SUSE CVE CVE-2013-1430 page https://www.suse.com/security/cve/CVE-2017-16927/ SUSE CVE CVE-2017-16927 page https://www.suse.com/security/cve/CVE-2017-6967/ SUSE CVE CVE-2017-6967 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE OpenStack Cloud 7 xrdp-0.9.0~git.1456906198.f422461-16.9.3 xrdp-0.9.0~git.1456906198.f422461-16.9.3 as a component of SUSE Enterprise Storage 4 xrdp-0.9.0~git.1456906198.f422461-16.9.3 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xrdp-0.9.0~git.1456906198.f422461-16.9.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xrdp-0.9.0~git.1456906198.f422461-16.9.3 as a component of SUSE OpenStack Cloud 7 An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key. CVE-2013-1430 SUSE Enterprise Storage 4:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server 12 SP2-LTSS:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE OpenStack Cloud 7:xrdp-0.9.0~git.1456906198.f422461-16.9.3 low 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191860-1/ https://www.suse.com/security/cve/CVE-2013-1430.html CVE-2013-1430 https://bugzilla.suse.com/1015567 SUSE Bug 1015567 https://bugzilla.suse.com/442182 SUSE Bug 442182 The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. CVE-2017-16927 SUSE Enterprise Storage 4:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server 12 SP2-LTSS:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE OpenStack Cloud 7:xrdp-0.9.0~git.1456906198.f422461-16.9.3 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191860-1/ https://www.suse.com/security/cve/CVE-2017-16927.html CVE-2017-16927 https://bugzilla.suse.com/1069591 SUSE Bug 1069591 https://bugzilla.suse.com/442182 SUSE Bug 442182 xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass. CVE-2017-6967 SUSE Enterprise Storage 4:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server 12 SP2-LTSS:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE OpenStack Cloud 7:xrdp-0.9.0~git.1456906198.f422461-16.9.3 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191860-1/ https://www.suse.com/security/cve/CVE-2017-6967.html CVE-2017-6967 https://bugzilla.suse.com/1029912 SUSE Bug 1029912 https://bugzilla.suse.com/442182 SUSE Bug 442182