Amazon Linux 2 : freerdp (ALAS-2026-4087)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-4087.
##

include('compat.inc');

if (description)
{
  script_id(377919);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/09");

  script_cve_id(
    "CVE-2026-109241",
    "CVE-2026-109242",
    "CVE-2026-109244",
    "CVE-2026-109677",
    "CVE-2026-109941",
    "CVE-2026-109942",
    "CVE-2026-109948",
    "CVE-2026-109953",
    "CVE-2026-110829",
    "CVE-2026-110832",
    "CVE-2026-110836",
    "CVE-2026-110837"
  );

  script_name(english:"Amazon Linux 2 : freerdp (ALAS-2026-4087)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-4087 advisory.

    FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection
    channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can
    send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it,
    causing client denial of service. (CVE-2026-109241)

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive
    tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a
    crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client
    process. (CVE-2026-109242)

    FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that
    creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can
    read world-readable key files or open PFX files protected by the hard-coded default password to steal
    private keys. (CVE-2026-109244)

    FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in
    smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP
    servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit
    to defeat ASLR and aid RCE exploits. (CVE-2026-109677)

    FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows
    malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a
    partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop
    forever and freeze the client decoder thread. (CVE-2026-109941)

    FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in
    libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only
    PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD
    Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
    (CVE-2026-109942)

    FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in
    smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send
    SCardTransmit requests with an invalid card handle and nonzero receive length, causing
    smartcard_pack_transmit_return to serialize up to 66,560 uninitialized heap bytes. (CVE-2026-109948)

    FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the
    /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password
    to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the
    Client Info PDU to obtain reusable administrative domain, username, and password values. (CVE-2026-109953)

    FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a
    fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed
    rdpsnd PDU on a fresh channel to crash the client and cause denial of service. (CVE-2026-110829)

    FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first
    that allows authenticated clients to force servers to commit large memory allocations. Attackers can send
    a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident
    memory growth and server resource exhaustion. (CVE-2026-110832)

    FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that
    allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a
    gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning
    a client thread at full CPU indefinitely. (CVE-2026-110836)

    FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer
    overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated
    as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap
    allocation, crashing the client. (CVE-2026-110837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-4087.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109241.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109242.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109244.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109677.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109941.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109942.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109948.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109953.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-110829.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-110832.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-110836.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-110837.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update freerdp' or
  or 'yum update --advisory ALAS2-2026-4087' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-109242");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-110837");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-110836");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'freerdp-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.18', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.18', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-2.11.7-1.amzn2.0.18', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freerdp / freerdp-debuginfo / freerdp-devel / etc");
}