Amazon Linux 2 : freerdp (ALAS-2026-3938)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-3938.
##

include('compat.inc');

if (description)
{
  script_id(351037);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/29");

  script_cve_id(
    "CVE-2026-85089",
    "CVE-2026-85090",
    "CVE-2026-91946",
    "CVE-2026-91947",
    "CVE-2026-91953",
    "CVE-2026-91956",
    "CVE-2026-91957",
    "CVE-2026-91958",
    "CVE-2026-91959",
    "CVE-2026-91963",
    "CVE-2026-91964"
  );

  script_name(english:"Amazon Linux 2 : freerdp (ALAS-2026-3938)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-3938 advisory.

    A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose
    sensitive information from the server or proxy process memory to a downstream client. This occurs because
    certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek
    instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap
    memory that may contain cleartext credentials from previous sessions. (CVE-2026-85089)

    A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the
    `general_ChromaV1ToYUV444` function during AVC444 chroma plane reconstruction. A remote attacker, acting
    as a malicious Remote Desktop Protocol (RDP) server, can exploit this by sending a specially crafted
    `RFX_AVC444_BITMAP_STREAM` with specific frame geometry. This can lead to an out-of-bounds memory read,
    potentially disclosing sensitive heap data to the client or causing a client crash, resulting in a denial
    of service. (CVE-2026-85090)

    FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's
    ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format.
    Attackers can receive uninitialized heap memory including live pointers and GLib function addresses
    transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address. (CVE-2026-91946)

    FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that
    dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race
    AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing
    freed channel objects. (CVE-2026-91947)

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in
    nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before
    writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server
    Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-
    controlled content, causing denial of service or heap corruption before authentication completes.
    (CVE-2026-91953)

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's
    func_get_ep_desc function that indexes interface arrays by position instead of protocol field
    InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted
    InterfaceNumber values to read past allocated heap memory and crash the client. (CVE-2026-91956)

    FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when
    worker thread creation fails after device registration. Attackers can trigger thread creation failure
    during channel setup to cause device pointer deallocation while devman retains a reference, leading to
    crash or code execution. (CVE-2026-91957)

    FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files,
    allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an
    out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in
    xfreerdp. (CVE-2026-91958)

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the
    RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to
    trigger an out-of-bounds read causing process abort. (CVE-2026-91959)

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc
    USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized
    heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory
    corruption vulnerabilities. (CVE-2026-91963)

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when
    processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious
    RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed
    512-byte buffer without validation, causing client crashes or potential code execution when chained with
    memory disclosure. (CVE-2026-91964)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-3938.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-85089.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-85090.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91946.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91947.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91953.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91956.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91957.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91958.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91959.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91963.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-91964.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update freerdp' or
  or 'yum update --advisory ALAS2-2026-3938' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-91963");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-91964");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-91964");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'freerdp-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.16', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.16', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.16', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freerdp / freerdp-debuginfo / freerdp-devel / etc");
}