Debian dla-4759 : xrdp - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4759. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(341538);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/29");

  script_cve_id(
    "CVE-2026-32105",
    "CVE-2026-32107",
    "CVE-2026-32623",
    "CVE-2026-32624",
    "CVE-2026-33516",
    "CVE-2026-33689",
    "CVE-2026-41252",
    "CVE-2026-41521",
    "CVE-2026-44178",
    "CVE-2026-44978",
    "CVE-2026-54538",
    "CVE-2026-55238",
    "CVE-2026-55639",
    "CVE-2026-55645"
  );

  script_name(english:"Debian dla-4759 : xrdp - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the
dla-4759 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4759-1                [email protected]
    https://www.debian.org/lts/security/                          Abhijith PA
    August 29, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : xrdp
    Version        : 0.9.21.1-1~deb11u4 0.9.21.1-1+deb12u3
    CVE ID         : CVE-2026-32105 CVE-2026-32107 CVE-2026-32623 CVE-2026-32624
                     CVE-2026-33516 CVE-2026-33689 CVE-2026-41252 CVE-2026-41521
                     CVE-2026-44178 CVE-2026-44978 CVE-2026-54538 CVE-2026-55238
                     CVE-2026-55639 CVE-2026-55645

    Several vulnerabilities were discovered in xrdp, a Remote Desktop
    Protocol (RDP) server.

    CVE-2026-32105

        modify encrypted traffic in transit without detection

    CVE-2026-32107

        improper privilege management allow attacker to escalate
        privileges to root and execute arbitrary code.

    CVE-2026-32623

        heap-based buffer overflow vulnerability

    CVE-2026-32624

        heap-based buffer overflow vulnerability

    CVE-2026-33516

        out-of-bounds read vulnerability

    CVE-2026-33689

        out-of-bounds read vulnerability

    CVE-2026-41252

        missing bounds check in xrdp, which allows a heap-based buffer
        overflow

    CVE-2026-41521

        integer overflow vulnerability

    CVE-2026-44178

        heap-based buffer overflow vulnerability

    CVE-2026-44978

        heap out-of-bounds read vulnerability

    CVE-2026-54538

        sending a specially crafted packet that forces the process into an
        infinite, CPU-bound loop

    CVE-2026-55238

        Denial of Service

    CVE-2026-55639

        exploit by specially crafted RDP malformed data and read
        out-of-bound data block.

    CVE-2026-55645

        out-of-bounds memory reads

    For Debian 11 bullseye, these problems have been fixed in version
    0.9.21.1-1~deb11u4.

    For Debian 12 bookworm, these problems have been fixed in version
    0.9.21.1-1+deb12u3.

    We recommend that you upgrade your xrdp packages.

    For the detailed security status of xrdp please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/xrdp

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/xrdp");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32105");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32107");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32623");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32624");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-33516");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-33689");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-41252");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-41521");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44178");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44978");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54538");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55238");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55639");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55645");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/xrdp");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/xrdp");
  script_set_attribute(attribute:"solution", value:
"Upgrade the xrdp packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41521");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-32105");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xrdp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'xrdp', 'reference': '0.9.21.1-1~deb11u4'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'xrdp');
}