DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENSUSE-2020-1090.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "openSUSE Security Update : freerdp (openSUSE-2020-1090)", "description": "This update for freerdp fixes the following issues :\n\nfrerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006) :\n\n - CVE-2020-11017: Fixed a double free which could have denied the server's service.\n\n - CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have triggered.\n\n - CVE-2020-11019: Fixed an issue which could have led to denial of service if logger was set to 'WLOG_TRACE'.\n\n - CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.\n\n - CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory read and write when USB redirection was enabled.\n\n - CVE-2020-11040: Fixed an out of bounds data read in clear_decompress_subcode_rlex.\n\n - CVE-2020-11041: Fixed an issue with the configuration for sound backend which could have led to server's denial of service.\n\n - CVE-2020-11043: Fixed an out of bounds read in rfx_process_message_tileset.\n\n - CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.\n\n - CVE-2020-11086: Fixed an out of bounds read in ntlm_read_ntlm_v2_client_challenge.\n\n - CVE-2020-11087: Fixed an out of bounds read in ntlm_read_AuthenticateMessage.\n\n - CVE-2020-11088: Fixed an out of bounds read in ntlm_read_NegotiateMessage.\n\n - CVE-2020-11089: Fixed an out of bounds read in irp function family.\n\n - CVE-2020-11095: Fixed a global out of bounds read in update_recv_primary_order.\n\n - CVE-2020-11096: Fixed a global out of bounds read in update_read_cache_bitmap_v3_order.\n\n - CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.\n\n - CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.\n\n - CVE-2020-11099: Fixed an out of bounds Read in license_read_new_or_upgrade_license_packet.\n\n - CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).\n\n - CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).\n\n - CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).\n\n - CVE-2020-11524: Fixed an out of bounds write in interleaved.c (bsc#1171446).\n\n - CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).\n\n - CVE-2020-11526: Fixed an out of bounds read in update_recv_secondary_order (bsc#1171674).\n\n - CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.\n\n - CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due to uninitialized value.\n\n - CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.\n\n - CVE-2020-4030: Fixed an out of bounds read in `TrioParse`.\n\n - CVE-2020-4031: Fixed a use after free in gdi_SelectObject.\n\n - CVE-2020-4032: Fixed an integer casting in `update_recv_secondary_order`.\n\n - CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.\n\n - Fixed an issue where freerdp failed with -fno-common (bsc#1169748).\n\n - Fixed an issue where USB redirection with FreeRDP was not working (bsc#1169679).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "published": "2020-07-28T00:00:00", "modified": "2020-09-24T00:00:00", "epss": [], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/139018", "reporter": "This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11096", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11524", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11039", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171444", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11097", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11522", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11099", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4033", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171445", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171447", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4030", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171474", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11085", "https://bugzilla.opensuse.org/show_bug.cgi?id=1173247", "https://bugzilla.opensuse.org/show_bug.cgi?id=1169748", "https://bugzilla.opensuse.org/show_bug.cgi?id=1169679", "https://bugzilla.opensuse.org/show_bug.cgi?id=1174200", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11523", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171441", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4032", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4031", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171446", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11017", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11088", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13396", "https://bugzilla.opensuse.org/show_bug.cgi?id=1173605", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11526", "https://bugzilla.opensuse.org/show_bug.cgi?id=1171443", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11098", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11086", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11089", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13397", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13398", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11095", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11087", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11525", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11521"], "cvelist": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11043", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"], "immutableFields": [], "lastseen": "2023-05-18T15:05:14", "viewCount": 12, "enchantments": {"dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4647", "ALSA-2021:1849"]}, {"type": "altlinux", "idList": ["13DC64858008E8F95F91B7B09F02D7C9", "657DE4F44E4431593569F572CAA597AB", "9CF67007F34EB37FD3C8F61DF82850F8"]}, {"type": "amazon", "idList": ["ALAS2-2020-1516"]}, {"type": "archlinux", "idList": ["ASA-202005-16", "ASA-202006-15"]}, {"type": "centos", "idList": ["CESA-2020:2334", "CESA-2020:2406", "CESA-2020:4031"]}, {"type": "cve", "idList": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11043", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2356-1:1D418", "DEBIAN:DLA-2356-1:A6932"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-11017", "DEBIANCVE:CVE-2020-11018", "DEBIANCVE:CVE-2020-11019", "DEBIANCVE:CVE-2020-11038", "DEBIANCVE:CVE-2020-11039", "DEBIANCVE:CVE-2020-11040", "DEBIANCVE:CVE-2020-11041", "DEBIANCVE:CVE-2020-11043", "DEBIANCVE:CVE-2020-11085", "DEBIANCVE:CVE-2020-11086", "DEBIANCVE:CVE-2020-11087", "DEBIANCVE:CVE-2020-11088", "DEBIANCVE:CVE-2020-11089", "DEBIANCVE:CVE-2020-11095", "DEBIANCVE:CVE-2020-11096", "DEBIANCVE:CVE-2020-11097", "DEBIANCVE:CVE-2020-11098", "DEBIANCVE:CVE-2020-11099", "DEBIANCVE:CVE-2020-11521", "DEBIANCVE:CVE-2020-11522", "DEBIANCVE:CVE-2020-11523", "DEBIANCVE:CVE-2020-11524", "DEBIANCVE:CVE-2020-11525", "DEBIANCVE:CVE-2020-11526", "DEBIANCVE:CVE-2020-13396", "DEBIANCVE:CVE-2020-13397", "DEBIANCVE:CVE-2020-13398", "DEBIANCVE:CVE-2020-4030", "DEBIANCVE:CVE-2020-4031", "DEBIANCVE:CVE-2020-4032", "DEBIANCVE:CVE-2020-4033"]}, {"type": "fedora", "idList": ["FEDORA:0706634E5267", "FEDORA:2D325323D664"]}, {"type": "freebsd", "idList": ["669F3FE8-A07A-11EA-B83E-F0DEF1F5C5A2"]}, {"type": "gentoo", "idList": ["GLSA-202005-07"]}, {"type": "mageia", "idList": ["MGASA-2020-0297"]}, {"type": "nessus", "idList": ["AL2_ALAS-2020-1516.NASL", "ALMA_LINUX_ALSA-2020-4647.NASL", "ALMA_LINUX_ALSA-2021-1849.NASL", "CENTOS8_RHSA-2020-2407.NASL", "CENTOS8_RHSA-2020-4647.NASL", "CENTOS8_RHSA-2021-1849.NASL", "CENTOS_RHSA-2020-2334.NASL", "CENTOS_RHSA-2020-2406.NASL", "CENTOS_RHSA-2020-4031.NASL", "DEBIAN_DLA-2356.NASL", "EULEROS_SA-2020-1801.NASL", "EULEROS_SA-2020-1848.NASL", "EULEROS_SA-2020-1917.NASL", "EULEROS_SA-2020-1937.NASL", "EULEROS_SA-2020-2064.NASL", "EULEROS_SA-2020-2245.NASL", "EULEROS_SA-2020-2343.NASL", "EULEROS_SA-2021-1066.NASL", "EULEROS_SA-2021-1188.NASL", "EULEROS_SA-2021-1295.NASL", "EULEROS_SA-2021-1472.NASL", "EULEROS_SA-2021-1675.NASL", "EULEROS_SA-2021-1785.NASL", "EULEROS_SA-2021-2370.NASL", "EULEROS_SA-2022-1564.NASL", "EULEROS_SA-2022-2457.NASL", "FEDORA_2020-8D5F86E29A.NASL", "FEDORA_2020-A3432485DB.NASL", "FREEBSD_PKG_669F3FE8A07A11EAB83EF0DEF1F5C5A2.NASL", "GENTOO_GLSA-202005-07.NASL", "NEWSTART_CGSL_NS-SA-2020-0076_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2021-0009_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2021-0047_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2021-0083_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2021-0143_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2021-0172_FREERDP.NASL", "NEWSTART_CGSL_NS-SA-2022-0063_FREERDP.NASL", "ORACLELINUX_ELSA-2020-2334.NASL", "ORACLELINUX_ELSA-2020-2336.NASL", "ORACLELINUX_ELSA-2020-2405.NASL", "ORACLELINUX_ELSA-2020-2406.NASL", "ORACLELINUX_ELSA-2020-2407.NASL", "ORACLELINUX_ELSA-2020-4647.NASL", "ORACLELINUX_ELSA-2021-1849.NASL", "REDHAT-RHSA-2020-2334.NASL", "REDHAT-RHSA-2020-2335.NASL", "REDHAT-RHSA-2020-2336.NASL", "REDHAT-RHSA-2020-2354.NASL", "REDHAT-RHSA-2020-2405.NASL", "REDHAT-RHSA-2020-2406.NASL", "REDHAT-RHSA-2020-2407.NASL", "REDHAT-RHSA-2020-2415.NASL", "REDHAT-RHSA-2020-2417.NASL", "REDHAT-RHSA-2020-4031.NASL", "REDHAT-RHSA-2020-4647.NASL", "REDHAT-RHSA-2021-1849.NASL", "SL_20200528_FREERDP_ON_SL7_X.NASL", "SL_20200609_FREERDP_ON_SL6_X.NASL", "SL_20200609_FREERDP_ON_SL7_X.NASL", "SL_20201001_FREERDP_ON_SL7_X.NASL", "UBUNTU_USN-4379-1.NASL", "UBUNTU_USN-4382-1.NASL", "UBUNTU_USN-4382-2.NASL", "UBUNTU_USN-4481-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310113703", "OPENVAS:1361412562310844455", "OPENVAS:1361412562310844457", "OPENVAS:1361412562310883242", "OPENVAS:1361412562310883246"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-2334", "ELSA-2020-2336", "ELSA-2020-2405", "ELSA-2020-2406", "ELSA-2020-2407", "ELSA-2020-4031", "ELSA-2020-4647", "ELSA-2021-1849"]}, {"type": "osv", "idList": ["OSV:DLA-2356-1"]}, {"type": "redhat", "idList": ["RHSA-2020:2334", "RHSA-2020:2335", "RHSA-2020:2336", "RHSA-2020:2354", "RHSA-2020:2405", "RHSA-2020:2406", "RHSA-2020:2407", "RHSA-2020:2415", "RHSA-2020:2417", "RHSA-2020:4031", "RHSA-2020:4647", "RHSA-2021:1849"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-11017", "RH:CVE-2020-11018", "RH:CVE-2020-11019", "RH:CVE-2020-11038", "RH:CVE-2020-11039", "RH:CVE-2020-11040", "RH:CVE-2020-11041", "RH:CVE-2020-11043", "RH:CVE-2020-11085", "RH:CVE-2020-11086", "RH:CVE-2020-11087", "RH:CVE-2020-11088", "RH:CVE-2020-11089", "RH:CVE-2020-11095", "RH:CVE-2020-11096", "RH:CVE-2020-11097", "RH:CVE-2020-11098", "RH:CVE-2020-11099", "RH:CVE-2020-11521", "RH:CVE-2020-11522", "RH:CVE-2020-11523", "RH:CVE-2020-11524", "RH:CVE-2020-11525", "RH:CVE-2020-11526", "RH:CVE-2020-13396", "RH:CVE-2020-13397", "RH:CVE-2020-13398", "RH:CVE-2020-4030", "RH:CVE-2020-4031", "RH:CVE-2020-4032", "RH:CVE-2020-4033"]}, {"type": "rocky", "idList": ["RLSA-2020:4647", "RLSA-2021:1849"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:1090-1"]}, {"type": "ubuntu", "idList": ["USN-4379-1", "USN-4382-1", "USN-4382-2", "USN-4481-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-11017", "UB:CVE-2020-11018", "UB:CVE-2020-11019", "UB:CVE-2020-11038", "UB:CVE-2020-11039", "UB:CVE-2020-11040", "UB:CVE-2020-11041", "UB:CVE-2020-11043", "UB:CVE-2020-11085", "UB:CVE-2020-11086", "UB:CVE-2020-11087", "UB:CVE-2020-11088", "UB:CVE-2020-11089", "UB:CVE-2020-11095", "UB:CVE-2020-11096", "UB:CVE-2020-11097", "UB:CVE-2020-11098", "UB:CVE-2020-11099", "UB:CVE-2020-11521", "UB:CVE-2020-11522", "UB:CVE-2020-11523", "UB:CVE-2020-11524", "UB:CVE-2020-11525", "UB:CVE-2020-11526", "UB:CVE-2020-13396", "UB:CVE-2020-13397", "UB:CVE-2020-13398", "UB:CVE-2020-4030", "UB:CVE-2020-4031", "UB:CVE-2020-4032", "UB:CVE-2020-4033"]}, {"type": "veracode", "idList": ["VERACODE:25514", "VERACODE:25515", "VERACODE:25516", "VERACODE:25617", "VERACODE:25800", "VERACODE:26154", "VERACODE:26155", "VERACODE:26157", "VERACODE:26158", "VERACODE:26159", "VERACODE:26218", "VERACODE:26219", "VERACODE:26220", "VERACODE:26221", "VERACODE:26222", "VERACODE:27472", "VERACODE:27473", "VERACODE:27474", "VERACODE:27475", "VERACODE:27476", "VERACODE:27477", "VERACODE:27478", "VERACODE:27486", "VERACODE:27487", "VERACODE:27488", "VERACODE:27489", "VERACODE:27490", "VERACODE:27491", "VERACODE:27492", "VERACODE:27493"]}]}, "score": {"value": 0.0, "vector": "NONE"}, "backreferences": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4647", "ALSA-2021:1849"]}, {"type": "amazon", "idList": ["ALAS2-2020-1516"]}, {"type": "archlinux", "idList": ["ASA-202005-16", "ASA-202006-15"]}, {"type": "centos", "idList": ["CESA-2020:2334", "CESA-2020:2406"]}, {"type": "cve", "idList": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11043", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2356-1:1D418"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-11017", "DEBIANCVE:CVE-2020-11018", "DEBIANCVE:CVE-2020-11019", "DEBIANCVE:CVE-2020-11038", "DEBIANCVE:CVE-2020-11039", "DEBIANCVE:CVE-2020-11040", "DEBIANCVE:CVE-2020-11041", "DEBIANCVE:CVE-2020-11043", "DEBIANCVE:CVE-2020-11085", "DEBIANCVE:CVE-2020-11086", "DEBIANCVE:CVE-2020-11087", "DEBIANCVE:CVE-2020-11088", "DEBIANCVE:CVE-2020-11089", "DEBIANCVE:CVE-2020-11095", "DEBIANCVE:CVE-2020-11096", "DEBIANCVE:CVE-2020-11097", "DEBIANCVE:CVE-2020-11098", "DEBIANCVE:CVE-2020-11099", "DEBIANCVE:CVE-2020-11521", "DEBIANCVE:CVE-2020-11522", "DEBIANCVE:CVE-2020-11523", "DEBIANCVE:CVE-2020-11524", "DEBIANCVE:CVE-2020-11525", "DEBIANCVE:CVE-2020-11526", "DEBIANCVE:CVE-2020-13396", "DEBIANCVE:CVE-2020-13397", "DEBIANCVE:CVE-2020-13398", "DEBIANCVE:CVE-2020-4030", "DEBIANCVE:CVE-2020-4031", "DEBIANCVE:CVE-2020-4032", "DEBIANCVE:CVE-2020-4033"]}, {"type": "fedora", "idList": ["FEDORA:0706634E5267", "FEDORA:2D325323D664"]}, {"type": "freebsd", "idList": ["669F3FE8-A07A-11EA-B83E-F0DEF1F5C5A2"]}, {"type": "gentoo", "idList": ["GLSA-202005-07"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/ALPINE-LINUX-CVE-2020-13398/", "MSF:ILITIES/CENTOS_LINUX-CVE-2020-13398/", "MSF:ILITIES/DEBIAN-CVE-2020-13398/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2020-13398/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2020-13398/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-13398/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-13398/", "MSF:ILITIES/ORACLE_LINUX-CVE-2020-13398/", "MSF:ILITIES/REDHAT_LINUX-CVE-2020-13398/", "MSF:ILITIES/SUSE-CVE-2020-13398/", "MSF:ILITIES/SUSE-CVE-2020-4030/", "MSF:ILITIES/SUSE-CVE-2020-4031/", "MSF:ILITIES/SUSE-CVE-2020-4032/", "MSF:ILITIES/UBUNTU-CVE-2020-13398/"]}, {"type": "nessus", "idList": ["CENTOS8_RHSA-2021-1849.NASL", "CENTOS_RHSA-2020-2406.NASL", "FREEBSD_PKG_669F3FE8A07A11EAB83EF0DEF1F5C5A2.NASL", "GENTOO_GLSA-202005-07.NASL", "ORACLELINUX_ELSA-2020-2334.NASL", "ORACLELINUX_ELSA-2020-2336.NASL", "ORACLELINUX_ELSA-2020-2405.NASL", "ORACLELINUX_ELSA-2020-2406.NASL", "ORACLELINUX_ELSA-2020-2407.NASL", "ORACLELINUX_ELSA-2020-4647.NASL", "ORACLELINUX_ELSA-2021-1849.NASL", "REDHAT-RHSA-2020-2335.NASL", "REDHAT-RHSA-2020-2336.NASL", "REDHAT-RHSA-2020-2354.NASL", "REDHAT-RHSA-2020-2405.NASL", "REDHAT-RHSA-2020-2406.NASL", "REDHAT-RHSA-2020-2407.NASL", "REDHAT-RHSA-2020-2415.NASL", "REDHAT-RHSA-2020-2417.NASL", "REDHAT-RHSA-2021-1849.NASL", "SL_20200528_FREERDP_ON_SL7_X.NASL", "SL_20200609_FREERDP_ON_SL6_X.NASL", "SL_20200609_FREERDP_ON_SL7_X.NASL", "UBUNTU_USN-4379-1.NASL", "UBUNTU_USN-4382-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310813061", "OPENVAS:1361412562310844455", "OPENVAS:1361412562310844457", "OPENVAS:1361412562310883242", "OPENVAS:1361412562310883246"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-2334", "ELSA-2020-2336", "ELSA-2020-2405", "ELSA-2020-2406", "ELSA-2020-2407", "ELSA-2020-4647", "ELSA-2021-1849"]}, {"type": "redhat", "idList": ["RHSA-2020:2405"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-11017", "RH:CVE-2020-11018", "RH:CVE-2020-11019", "RH:CVE-2020-11038", "RH:CVE-2020-11039", "RH:CVE-2020-11040", "RH:CVE-2020-11041", "RH:CVE-2020-11043", "RH:CVE-2020-11085", "RH:CVE-2020-11086", "RH:CVE-2020-11087", "RH:CVE-2020-11088", "RH:CVE-2020-11089", "RH:CVE-2020-11095", "RH:CVE-2020-11096", "RH:CVE-2020-11097", "RH:CVE-2020-11098", "RH:CVE-2020-11099", "RH:CVE-2020-11521", "RH:CVE-2020-11522", "RH:CVE-2020-11523", "RH:CVE-2020-11524", "RH:CVE-2020-11525", "RH:CVE-2020-11526", "RH:CVE-2020-13396", "RH:CVE-2020-13397", "RH:CVE-2020-13398", "RH:CVE-2020-4030", "RH:CVE-2020-4031", "RH:CVE-2020-4032", "RH:CVE-2020-4033"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:1090-1"]}, {"type": "ubuntu", "idList": ["USN-4379-1", "USN-4382-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-11017", "UB:CVE-2020-11018", "UB:CVE-2020-11038", "UB:CVE-2020-11039", "UB:CVE-2020-11040", "UB:CVE-2020-11041", "UB:CVE-2020-11043", "UB:CVE-2020-11085", "UB:CVE-2020-11086", "UB:CVE-2020-11087", "UB:CVE-2020-11088", "UB:CVE-2020-11089", "UB:CVE-2020-11095", "UB:CVE-2020-11096", "UB:CVE-2020-11097", "UB:CVE-2020-11098", "UB:CVE-2020-11099", "UB:CVE-2020-11521", "UB:CVE-2020-11522", "UB:CVE-2020-11523", "UB:CVE-2020-11524", "UB:CVE-2020-11525", "UB:CVE-2020-11526", "UB:CVE-2020-13396", "UB:CVE-2020-13397", "UB:CVE-2020-13398", "UB:CVE-2020-4030", "UB:CVE-2020-4031", "UB:CVE-2020-4032", "UB:CVE-2020-4033"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2020-11017", "epss": 0.00053, "percentile": 0.19316, "modified": "2023-05-07"}, {"cve": "CVE-2020-11018", "epss": 0.00053, "percentile": 0.19316, "modified": "2023-05-07"}, {"cve": "CVE-2020-11019", "epss": 0.00053, "percentile": 0.19316, "modified": "2023-05-07"}, {"cve": "CVE-2020-11038", "epss": 0.00063, "percentile": 0.25366, "modified": "2023-05-07"}, {"cve": "CVE-2020-11039", "epss": 0.00076, "percentile": 0.30946, "modified": "2023-05-07"}, {"cve": "CVE-2020-11040", "epss": 0.00076, "percentile": 0.30946, "modified": "2023-05-07"}, {"cve": "CVE-2020-11041", "epss": 0.0009, "percentile": 0.37209, "modified": "2023-05-07"}, {"cve": "CVE-2020-11043", "epss": 0.00076, "percentile": 0.30946, "modified": "2023-05-07"}, {"cve": "CVE-2020-11085", "epss": 0.00093, "percentile": 0.38171, "modified": "2023-05-07"}, {"cve": "CVE-2020-11086", "epss": 0.00093, "percentile": 0.38171, "modified": "2023-05-07"}, {"cve": "CVE-2020-11087", "epss": 0.00093, "percentile": 0.38171, "modified": "2023-05-07"}, {"cve": "CVE-2020-11088", "epss": 0.00096, "percentile": 0.39067, "modified": "2023-05-07"}, {"cve": "CVE-2020-11089", "epss": 0.0011, "percentile": 0.42719, "modified": "2023-05-07"}, {"cve": "CVE-2020-11095", "epss": 0.00135, "percentile": 0.47264, "modified": "2023-05-07"}, {"cve": "CVE-2020-11096", "epss": 0.00278, "percentile": 0.63556, "modified": "2023-05-07"}, {"cve": "CVE-2020-11097", "epss": 0.0012, "percentile": 0.44842, "modified": "2023-05-07"}, {"cve": "CVE-2020-11098", "epss": 0.00278, "percentile": 0.63556, "modified": "2023-05-07"}, {"cve": "CVE-2020-11099", "epss": 0.00225, "percentile": 0.59275, "modified": "2023-05-07"}, {"cve": "CVE-2020-11521", "epss": 0.00369, "percentile": 0.68433, "modified": "2023-05-07"}, {"cve": "CVE-2020-11522", "epss": 0.00488, "percentile": 0.72496, "modified": "2023-05-07"}, {"cve": "CVE-2020-11523", "epss": 0.01484, "percentile": 0.84834, "modified": "2023-05-07"}, {"cve": "CVE-2020-11524", "epss": 0.00428, "percentile": 0.70628, "modified": "2023-05-07"}, {"cve": "CVE-2020-11525", "epss": 0.00336, "percentile": 0.66929, "modified": "2023-05-07"}, {"cve": "CVE-2020-11526", "epss": 0.0013, "percentile": 0.46435, "modified": "2023-05-07"}, {"cve": "CVE-2020-13396", "epss": 0.00113, "percentile": 0.43338, "modified": "2023-05-07"}, {"cve": "CVE-2020-13397", "epss": 0.00046, "percentile": 0.12923, "modified": "2023-05-07"}, {"cve": "CVE-2020-13398", "epss": 0.00113, "percentile": 0.43338, "modified": "2023-05-07"}, {"cve": "CVE-2020-4030", "epss": 0.00158, "percentile": 0.50894, "modified": "2023-05-07"}, {"cve": "CVE-2020-4031", "epss": 0.00434, "percentile": 0.70857, "modified": "2023-05-07"}, {"cve": "CVE-2020-4032", "epss": 0.00116, "percentile": 0.43988, "modified": "2023-05-07"}, {"cve": "CVE-2020-4033", "epss": 0.00278, "percentile": 0.63556, "modified": "2023-05-07"}], "vulnersScore": 0.0}, "_state": {"dependencies": 1684442002, "score": 1698840310, "epss": 0}, "_internal": {"score_hash": "f164e1c65f0068e4284b7eddda7c90a0"}, "pluginID": "139018", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-1090.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(139018);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/24\");\n\n script_cve_id(\"CVE-2020-11017\", \"CVE-2020-11018\", \"CVE-2020-11019\", \"CVE-2020-11038\", \"CVE-2020-11039\", \"CVE-2020-11040\", \"CVE-2020-11041\", \"CVE-2020-11043\", \"CVE-2020-11085\", \"CVE-2020-11086\", \"CVE-2020-11087\", \"CVE-2020-11088\", \"CVE-2020-11089\", \"CVE-2020-11095\", \"CVE-2020-11096\", \"CVE-2020-11097\", \"CVE-2020-11098\", \"CVE-2020-11099\", \"CVE-2020-11521\", \"CVE-2020-11522\", \"CVE-2020-11523\", \"CVE-2020-11524\", \"CVE-2020-11525\", \"CVE-2020-11526\", \"CVE-2020-13396\", \"CVE-2020-13397\", \"CVE-2020-13398\", \"CVE-2020-4030\", \"CVE-2020-4031\", \"CVE-2020-4032\", \"CVE-2020-4033\");\n\n script_name(english:\"openSUSE Security Update : freerdp (openSUSE-2020-1090)\");\n script_summary(english:\"Check for the openSUSE-2020-1090 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for freerdp fixes the following issues :\n\nfrerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and\njsc#ECO-2006) :\n\n - CVE-2020-11017: Fixed a double free which could have\n denied the server's service.\n\n - CVE-2020-11018: Fixed an out of bounds read which a\n malicious clients could have triggered.\n\n - CVE-2020-11019: Fixed an issue which could have led to\n denial of service if logger was set to 'WLOG_TRACE'.\n\n - CVE-2020-11038: Fixed a buffer overflow when /video\n redirection was used.\n\n - CVE-2020-11039: Fixed an issue which could have allowed\n arbitrary memory read and write when USB redirection was\n enabled.\n\n - CVE-2020-11040: Fixed an out of bounds data read in\n clear_decompress_subcode_rlex.\n\n - CVE-2020-11041: Fixed an issue with the configuration\n for sound backend which could have led to server's\n denial of service.\n\n - CVE-2020-11043: Fixed an out of bounds read in\n rfx_process_message_tileset.\n\n - CVE-2020-11085: Fixed an out of bounds read in\n cliprdr_read_format_list.\n\n - CVE-2020-11086: Fixed an out of bounds read in\n ntlm_read_ntlm_v2_client_challenge.\n\n - CVE-2020-11087: Fixed an out of bounds read in\n ntlm_read_AuthenticateMessage.\n\n - CVE-2020-11088: Fixed an out of bounds read in\n ntlm_read_NegotiateMessage.\n\n - CVE-2020-11089: Fixed an out of bounds read in irp\n function family.\n\n - CVE-2020-11095: Fixed a global out of bounds read in\n update_recv_primary_order.\n\n - CVE-2020-11096: Fixed a global out of bounds read in\n update_read_cache_bitmap_v3_order.\n\n - CVE-2020-11097: Fixed an out of bounds read in\n ntlm_av_pair_get.\n\n - CVE-2020-11098: Fixed an out of bounds read in\n glyph_cache_put.\n\n - CVE-2020-11099: Fixed an out of bounds Read in\n license_read_new_or_upgrade_license_packet.\n\n - CVE-2020-11521: Fixed an out of bounds write in planar.c\n (bsc#1171443).\n\n - CVE-2020-11522: Fixed an out of bounds read in gdi.c\n (bsc#1171444).\n\n - CVE-2020-11523: Fixed an integer overflow in region.c\n (bsc#1171445).\n\n - CVE-2020-11524: Fixed an out of bounds write in\n interleaved.c (bsc#1171446).\n\n - CVE-2020-11525: Fixed an out of bounds read in bitmap.c\n (bsc#1171447).\n\n - CVE-2020-11526: Fixed an out of bounds read in\n update_recv_secondary_order (bsc#1171674).\n\n - CVE-2020-13396: Fixed an Read in\n ntlm_read_ChallengeMessage.\n\n - CVE-2020-13397: Fixed an out of bounds read in\n security_fips_decrypt due to uninitialized value.\n\n - CVE-2020-13398: Fixed an out of bounds write in\n crypto_rsa_common.\n\n - CVE-2020-4030: Fixed an out of bounds read in\n `TrioParse`.\n\n - CVE-2020-4031: Fixed a use after free in\n gdi_SelectObject.\n\n - CVE-2020-4032: Fixed an integer casting in\n `update_recv_secondary_order`.\n\n - CVE-2020-4033: Fixed an out of bound read in\n RLEDECOMPRESS.\n\n - Fixed an issue where freerdp failed with -fno-common\n (bsc#1169748).\n\n - Fixed an issue where USB redirection with FreeRDP was\n not working (bsc#1169679).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169679\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169748\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171441\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171443\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171444\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171445\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171446\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171447\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1171474\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1173247\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1173605\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1174200\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected freerdp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-proxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-proxy-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-server-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-wayland\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:freerdp-wayland-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libfreerdp2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libfreerdp2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libuwac0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libuwac0-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwinpr2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwinpr2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:uwac0-0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:winpr2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/07/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-debugsource-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-devel-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-proxy-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-proxy-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-server-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-server-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-wayland-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"freerdp-wayland-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libfreerdp2-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libfreerdp2-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libuwac0-0-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libuwac0-0-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libwinpr2-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libwinpr2-debuginfo-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"uwac0-0-devel-2.1.2-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"winpr2-devel-2.1.2-lp151.5.6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc\");\n}\n", "naslFamily": "SuSE Local Security Checks", "cpe": ["p-cpe:/a:novell:opensuse:freerdp", "p-cpe:/a:novell:opensuse:freerdp-debuginfo", "p-cpe:/a:novell:opensuse:freerdp-debugsource", "p-cpe:/a:novell:opensuse:freerdp-devel", "p-cpe:/a:novell:opensuse:freerdp-proxy", "p-cpe:/a:novell:opensuse:freerdp-proxy-debuginfo", "p-cpe:/a:novell:opensuse:freerdp-server", "p-cpe:/a:novell:opensuse:freerdp-server-debuginfo", "p-cpe:/a:novell:opensuse:freerdp-wayland", "p-cpe:/a:novell:opensuse:freerdp-wayland-debuginfo", "p-cpe:/a:novell:opensuse:libfreerdp2", "p-cpe:/a:novell:opensuse:libfreerdp2-debuginfo", "p-cpe:/a:novell:opensuse:libuwac0-0", "p-cpe:/a:novell:opensuse:libuwac0-0-debuginfo", "p-cpe:/a:novell:opensuse:libwinpr2", "p-cpe:/a:novell:opensuse:libwinpr2-debuginfo", "p-cpe:/a:novell:opensuse:uwac0-0-devel", "p-cpe:/a:novell:opensuse:winpr2-devel", "cpe:/o:novell:opensuse:15.1"], "solution": "Update the affected freerdp packages.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-13398", "vendor_cvss2": {"score": 6.5, "vector": "CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "vendor_cvss3": {"score": 8.3, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}, "vpr": {"risk factor": "Medium", "score": "6.7"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-07-26T00:00:00", "vulnerabilityPublicationDate": "2020-05-15T00:00:00", "exploitableWith": []}

{"suse": [{"lastseen": "2022-11-09T21:01:42", "description": "An update that fixes 31 vulnerabilities is now available.\n\nDescription:\n\n This update for freerdp fixes the following issues:\n\n frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and\n jsc#ECO-2006):\n\n - CVE-2020-11017: Fixed a double free which could have denied the server's\n service.\n - CVE-2020-11018: Fixed an out of bounds read which a malicious clients\n could have triggered.\n - CVE-2020-11019: Fixed an issue which could have led to denial of service\n if logger was set to \"WLOG_TRACE\".\n - CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.\n - CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory\n read and write when USB redirection was enabled.\n - CVE-2020-11040: Fixed an out of bounds data read in\n clear_decompress_subcode_rlex.\n - CVE-2020-11041: Fixed an issue with the configuration for sound backend\n which could have led to server's denial of service.\n - CVE-2020-11043: Fixed an out of bounds read in\n rfx_process_message_tileset.\n - CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.\n - CVE-2020-11086: Fixed an out of bounds read in\n ntlm_read_ntlm_v2_client_challenge.\n - CVE-2020-11087: Fixed an out of bounds read in\n ntlm_read_AuthenticateMessage.\n - CVE-2020-11088: Fixed an out of bounds read in\n ntlm_read_NegotiateMessage.\n - CVE-2020-11089: Fixed an out of bounds read in irp function family.\n - CVE-2020-11095: Fixed a global out of bounds read in\n update_recv_primary_order.\n - CVE-2020-11096: Fixed a global out of bounds read in\n update_read_cache_bitmap_v3_order.\n - CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.\n - CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.\n - CVE-2020-11099: Fixed an out of bounds Read in\n license_read_new_or_upgrade_license_packet.\n - CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).\n - CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).\n - CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).\n - CVE-2020-11524: Fixed an out of bounds write in interleaved.c\n (bsc#1171446).\n - CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).\n - CVE-2020-11526: Fixed an out of bounds read in\n update_recv_secondary_order (bsc#1171674).\n - CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.\n - CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due\n to uninitialized value.\n - CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.\n - CVE-2020-4030: Fixed an out of bounds read in `TrioParse`.\n - CVE-2020-4031: Fixed a use after free in gdi_SelectObject.\n - CVE-2020-4032: Fixed an integer casting in `update_recv_secondary_order`.\n - CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.\n - Fixed an issue where freerdp failed with -fno-common (bsc#1169748).\n - Fixed an issue where USB redirection with FreeRDP was not working\n (bsc#1169679).\n\n This update was imported from the SUSE:SLE-15-SP1:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2020-1090=1", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.5}, "published": "2020-07-26T00:00:00", "type": "suse", "title": "Security update for freerdp (important)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11043", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"], "modified": "2020-07-26T00:00:00", "id": "OPENSUSE-SU-2020:1090-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PMFBUGT3IBZIELBHFAWBVPCGUFYQHVRD/", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2023-05-18T15:01:26", "description": "The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4", "cvss3": {}, "published": "2020-06-09T00:00:00", "type": "nessus", "title": "FreeBSD : FreeRDP -- multiple vulnerabilities (669f3fe8-a07a-11ea-b83e-f0def1f5c5a2)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11043", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526"], "modified": "2022-05-13T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:freerdp", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_669F3FE8A07A11EAB83EF0DEF1F5C5A2.NASL", "href": "https://www.tenable.com/plugins/nessus/137249", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2020 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137249);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/13\");\n\n script_cve_id(\n \"CVE-2020-11017\",\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11043\",\n \"CVE-2020-11521\",\n \"CVE-2020-11522\",\n \"CVE-2020-11523\",\n \"CVE-2020-11524\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\"\n );\n\n script_name(english:\"FreeBSD : FreeRDP -- multiple vulnerabilities (669f3fe8-a07a-11ea-b83e-f0def1f5c5a2)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote FreeBSD host is missing a security-related update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/FreeRDP/FreeRDP/blob/2.1.1/ChangeLog\");\n # https://vuxml.freebsd.org/freebsd/669f3fe8-a07a-11ea-b83e-f0def1f5c5a2.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?84d25e59\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-11039\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/10\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"freerdp<2.1.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-02T15:05:25", "description": "According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0. (CVE-2020-11017)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to 'WLOG_TRACE', a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2022-04-25T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2022-1564)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11058", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13397", "CVE-2020-15103", "CVE-2020-4030"], "modified": "2023-10-31T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:freerdp", "p-cpe:/a:huawei:euleros:freerdp-libs", "p-cpe:/a:huawei:euleros:libwinpr", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2022-1564.NASL", "href": "https://www.tenable.com/plugins/nessus/160170", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(160170);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/31\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-11017\",\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11058\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11521\",\n \"CVE-2020-11523\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13397\",\n \"CVE-2020-15103\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2022-1564)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by\nthe following vulnerabilities :\n\n - In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a\n double free condition and crash the server. This is fixed in version 2.1.0. (CVE-2020-11017)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to 'WLOG_TRACE', a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in\n rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked\n against local surface coordinates and blindly accepted. A malicious server can send data that will crash\n the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a\n workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string\n length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security\nadvisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional\nissues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2022-1564\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d18404db\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4030\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-11523\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nvar uvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nvar sp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nvar flag = 0;\n\nvar pkgs = [\n \"freerdp-2.0.0-44.rc3.h11.eulerosv2r8\",\n \"freerdp-libs-2.0.0-44.rc3.h11.eulerosv2r8\",\n \"libwinpr-2.0.0-44.rc3.h11.eulerosv2r8\"\n];\n\nforeach (var pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:57:27", "description": "According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.(CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.(CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.(CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.(CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.(CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.(CVE-2020-11098)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-11-03T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP2 : freerdp (EulerOS-SA-2020-2343)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11089", "CVE-2020-11098", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-4033"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:freerdp", "p-cpe:/a:huawei:euleros:freerdp-libs", "p-cpe:/a:huawei:euleros:freerdp-plugins", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-2343.NASL", "href": "https://www.tenable.com/plugins/nessus/142342", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142342);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2020-11089\",\n \"CVE-2020-11098\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\",\n \"CVE-2020-4033\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : freerdp (EulerOS-SA-2020-2343)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the freerdp packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4\n has an Out-of-bounds Read.(CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0\n through 2.0.0-rc4 has an Out of bounds\n read.(CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in\n libfreerdp/core/security.c due to an uninitialized\n value.(CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in\n libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read\n in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write,\n printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in\n 2.1.0.(CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, there is an out of\n bounds read in RLEDECOMPRESS. All FreeRDP based clients\n with sessions with color depth < 32 are affected. This\n is fixed in version 2.1.2.(CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, there is an\n out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This\n is fixed in version 2.1.2.(CVE-2020-11098)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2343\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dc384e6c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"freerdp-1.0.2-6.1.h8\",\n \"freerdp-libs-1.0.2-6.1.h8\",\n \"freerdp-plugins-1.0.2-6.1.h8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-04T15:44:56", "description": "Bugfix and CVE release.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-07-30T00:00:00", "type": "nessus", "title": "Fedora 32 : 2:freerdp (2020-8d5f86e29a)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"], "modified": "2020-09-24T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:2:freerdp", "cpe:/o:fedoraproject:fedora:32"], "id": "FEDORA_2020-8D5F86E29A.NASL", "href": "https://www.tenable.com/plugins/nessus/139103", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2020-8d5f86e29a.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(139103);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/24\");\n\n script_cve_id(\"CVE-2020-11095\", \"CVE-2020-11096\", \"CVE-2020-11097\", \"CVE-2020-11098\", \"CVE-2020-11099\", \"CVE-2020-15103\", \"CVE-2020-4030\", \"CVE-2020-4031\", \"CVE-2020-4032\", \"CVE-2020-4033\");\n script_xref(name:\"FEDORA\", value:\"2020-8d5f86e29a\");\n\n script_name(english:\"Fedora 32 : 2:freerdp (2020-8d5f86e29a)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Bugfix and CVE release.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2020-8d5f86e29a\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected 2:freerdp package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:2:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:32\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/07/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^32([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 32\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC32\", reference:\"freerdp-2.2.0-1.fc32\", epoch:\"2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"2:freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-04T15:46:52", "description": "Bugfix and CVE release.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-08-03T00:00:00", "type": "nessus", "title": "Fedora 31 : 2:freerdp (2020-a3432485db)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"], "modified": "2020-09-24T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:2:freerdp", "cpe:/o:fedoraproject:fedora:31"], "id": "FEDORA_2020-A3432485DB.NASL", "href": "https://www.tenable.com/plugins/nessus/139263", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2020-a3432485db.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(139263);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/24\");\n\n script_cve_id(\"CVE-2020-11095\", \"CVE-2020-11096\", \"CVE-2020-11097\", \"CVE-2020-11098\", \"CVE-2020-11099\", \"CVE-2020-15103\", \"CVE-2020-4030\", \"CVE-2020-4031\", \"CVE-2020-4032\", \"CVE-2020-4033\");\n script_xref(name:\"FEDORA\", value:\"2020-a3432485db\");\n\n script_name(english:\"Fedora 31 : 2:freerdp (2020-a3432485db)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Bugfix and CVE release.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2020-a3432485db\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected 2:freerdp package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:2:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:31\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^31([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 31\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC31\", reference:\"freerdp-2.2.0-1.fc31\", epoch:\"2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"2:freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-05T15:43:02", "description": "It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-09-02T00:00:00", "type": "nessus", "title": "Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4481-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-server2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow-subsystem2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp2-2", "p-cpe:/a:canonical:ubuntu_linux:libuwac0-0", "p-cpe:/a:canonical:ubuntu_linux:libuwac0-dev", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-tools2-2", "p-cpe:/a:canonical:ubuntu_linux:libwinpr2-2", "p-cpe:/a:canonical:ubuntu_linux:libwinpr2-dev", "p-cpe:/a:canonical:ubuntu_linux:winpr-utils", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-dev", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-shadow-x11", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-wayland", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-x11"], "id": "UBUNTU_USN-4481-1.NASL", "href": "https://www.tenable.com/plugins/nessus/140179", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4481-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(140179);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\",\n \"CVE-2020-4030\",\n \"CVE-2020-4031\",\n \"CVE-2020-4032\",\n \"CVE-2020-4033\"\n );\n script_xref(name:\"USN\", value:\"4481-1\");\n\n script_name(english:\"Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4481-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"It was discovered that FreeRDP incorrectly handled certain memory\noperations. A remote attacker could use this issue to cause FreeRDP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4481-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-server2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow-subsystem2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libuwac0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libuwac0-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-tools2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:winpr-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp2-shadow-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp2-wayland\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp2-x11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('18.04' >< os_release || '20.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 18.04 / 20.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '18.04', 'pkgname': 'freerdp2-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'freerdp2-shadow-x11', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'freerdp2-wayland', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'freerdp2-x11', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-client2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-server2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-shadow-subsystem2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-shadow2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libfreerdp2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libuwac0-0', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libuwac0-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwinpr-tools2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwinpr2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwinpr2-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'winpr-utils', 'pkgver': '2.2.0+dfsg1-0ubuntu0.18.04.1'},\n {'osver': '20.04', 'pkgname': 'freerdp2-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'freerdp2-shadow-x11', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'freerdp2-wayland', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'freerdp2-x11', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libfreerdp-client2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libfreerdp-server2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libfreerdp-shadow-subsystem2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libfreerdp-shadow2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libfreerdp2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libuwac0-0', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libuwac0-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libwinpr-tools2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libwinpr2-2', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'libwinpr2-dev', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'},\n {'osver': '20.04', 'pkgname': 'winpr-utils', 'pkgver': '2.2.0+dfsg1-0ubuntu0.20.04.1'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp2-dev / freerdp2-shadow-x11 / freerdp2-wayland / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:47", "description": "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Multiple Vulnerabilities (NS-SA-2021-0047)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-10T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2021-0047_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/147410", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0047. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147410);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/10\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n\n script_name(english:\"NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Multiple Vulnerabilities (NS-SA-2021-0047)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected\nby multiple vulnerabilities:\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0047\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL CORE 5.04\" &&\n release !~ \"CGSL MAIN 5.04\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nflag = 0;\n\npkgs = {\n 'CGSL CORE 5.04': [\n 'freerdp-2.1.1-2.el7',\n 'freerdp-devel-2.1.1-2.el7',\n 'freerdp-libs-2.1.1-2.el7',\n 'libwinpr-2.1.1-2.el7',\n 'libwinpr-devel-2.1.1-2.el7'\n ],\n 'CGSL MAIN 5.04': [\n 'freerdp-2.1.1-2.el7',\n 'freerdp-devel-2.1.1-2.el7',\n 'freerdp-libs-2.1.1-2.el7',\n 'libwinpr-2.1.1-2.el7',\n 'libwinpr-devel-2.1.1-2.el7'\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:23:13", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4031 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-09-29T00:00:00", "type": "nessus", "title": "RHEL 7 : freerdp (RHSA-2020:4031)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel"], "id": "REDHAT-RHSA-2020-4031.NASL", "href": "https://www.tenable.com/plugins/nessus/141014", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4031. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141014);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4031\");\n\n script_name(english:\"RHEL 7 : freerdp (RHSA-2020:4031)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:4031 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read\n (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read\n (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later\n (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11038\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11039\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11040\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11041\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11043\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11044\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11045\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11047\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11048\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11085\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11087\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11088\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11089\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11522\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11525\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13396\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13397\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4031\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835391\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835399\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835403\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835762\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835772\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836223\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836239\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836247\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1841189\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1841196\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844171\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844177\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848012\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848022\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848029\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848034\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848038\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 119, 125, 129, 190, 476, 672, 770, 787, 805);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/os',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/os',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/supplementary/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/debug',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/debug',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/os',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/os',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/os',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/client/7/7Client/x86_64/os',\n 'content/dist/rhel/client/7/7Client/x86_64/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/os',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/os',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/os',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/os',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/os',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/os',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/os',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/os',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/server/7/7Server/x86_64/os',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/os',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/os',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/os',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/os',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/os',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/source/SRPMS',\n 'content/fastrack/rhel/client/7/x86_64/debug',\n 'content/fastrack/rhel/client/7/x86_64/optional/debug',\n 'content/fastrack/rhel/client/7/x86_64/optional/os',\n 'content/fastrack/rhel/client/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/client/7/x86_64/os',\n 'content/fastrack/rhel/client/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/computenode/7/x86_64/debug',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/debug',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/os',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/computenode/7/x86_64/os',\n 'content/fastrack/rhel/computenode/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/power/7/ppc64/debug',\n 'content/fastrack/rhel/power/7/ppc64/optional/debug',\n 'content/fastrack/rhel/power/7/ppc64/optional/os',\n 'content/fastrack/rhel/power/7/ppc64/optional/source/SRPMS',\n 'content/fastrack/rhel/power/7/ppc64/os',\n 'content/fastrack/rhel/power/7/ppc64/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/debug',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/debug',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/os',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/optional/debug',\n 'content/fastrack/rhel/server/7/x86_64/optional/os',\n 'content/fastrack/rhel/server/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/os',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/debug',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/os',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/system-z/7/s390x/debug',\n 'content/fastrack/rhel/system-z/7/s390x/optional/debug',\n 'content/fastrack/rhel/system-z/7/s390x/optional/os',\n 'content/fastrack/rhel/system-z/7/s390x/optional/source/SRPMS',\n 'content/fastrack/rhel/system-z/7/s390x/os',\n 'content/fastrack/rhel/system-z/7/s390x/source/SRPMS',\n 'content/fastrack/rhel/workstation/7/x86_64/debug',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/debug',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/os',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/workstation/7/x86_64/os',\n 'content/fastrack/rhel/workstation/7/x86_64/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'ppc64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'ppc64le', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-2.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:25:04", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4647 advisory.\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-11-12T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : freerdp / and / vinagre (ELSA-2020-4647)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-11T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:freerdp", "p-cpe:/a:oracle:linux:freerdp-devel", "p-cpe:/a:oracle:linux:freerdp-libs", "p-cpe:/a:oracle:linux:libwinpr", "p-cpe:/a:oracle:linux:libwinpr-devel", "p-cpe:/a:oracle:linux:vinagre"], "id": "ORACLELINUX_ELSA-2020-4647.NASL", "href": "https://www.tenable.com/plugins/nessus/142775", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-4647.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142775);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/11\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n\n script_name(english:\"Oracle Linux 8 : freerdp / and / vinagre (ELSA-2020-4647)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2020-4647 advisory.\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2020-4647.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vinagre\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\npkgs = [\n {'reference':'freerdp-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'i686', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'cpu':'i686', 'release':'8', 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'cpu':'i686', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'cpu':'i686', 'release':'8', 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'aarch64', 'release':'8'},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / etc');\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:23:13", "description": "The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1516 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-10-28T00:00:00", "type": "nessus", "title": "Amazon Linux 2 : freerdp (ALAS-2020-1516)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-11T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:freerdp", "p-cpe:/a:amazon:linux:freerdp-debuginfo", "p-cpe:/a:amazon:linux:freerdp-devel", "p-cpe:/a:amazon:linux:freerdp-libs", "p-cpe:/a:amazon:linux:libwinpr", "p-cpe:/a:amazon:linux:libwinpr-devel", "cpe:/o:amazon:linux:2"], "id": "AL2_ALAS-2020-1516.NASL", "href": "https://www.tenable.com/plugins/nessus/141989", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n# \n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux 2 Security Advisory ALAS-2020-1516.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141989);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/11\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"ALAS\", value:\"2020-1516\");\n\n script_name(english:\"Amazon Linux 2 : freerdp (ALAS-2020-1516)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Amazon Linux 2 host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the ALAS2-2020-1516 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/AL2/ALAS-2020-1516.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11038\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11039\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11040\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11041\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11043\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11044\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11045\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11047\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11048\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11085\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11087\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11088\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11089\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11522\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11525\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13396\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13397\");\n script_set_attribute(attribute:\"solution\", value:\n\"Run 'yum update freerdp' to update your system.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux:2\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"2\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux 2\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\npkgs = [\n {'reference':'freerdp-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'freerdp-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'freerdp-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'freerdp-debuginfo-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'freerdp-debuginfo-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'freerdp-debuginfo-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'freerdp-devel-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'freerdp-devel-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'freerdp-devel-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'freerdp-libs-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'freerdp-libs-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'freerdp-libs-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'libwinpr-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'libwinpr-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'libwinpr-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'libwinpr-devel-2.1.1-2.amzn2', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'libwinpr-devel-2.1.1-2.amzn2', 'cpu':'i686', 'release':'AL2'},\n {'reference':'libwinpr-devel-2.1.1-2.amzn2', 'cpu':'x86_64', 'release':'AL2'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-debuginfo / freerdp-devel / etc\");\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:23:40", "description": "The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4031 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-10-20T00:00:00", "type": "nessus", "title": "CentOS 7 : freerdp (CESA-2020:4031)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-11T00:00:00", "cpe": ["p-cpe:/a:centos:centos:freerdp", "p-cpe:/a:centos:centos:freerdp-devel", "p-cpe:/a:centos:centos:freerdp-libs", "p-cpe:/a:centos:centos:libwinpr", "p-cpe:/a:centos:centos:libwinpr-devel", "cpe:/o:centos:centos:7"], "id": "CENTOS_RHSA-2020-4031.NASL", "href": "https://www.tenable.com/plugins/nessus/141578", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4031 and\n# CentOS Errata and Security Advisory 2020:4031 respectively.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141578);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/11\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4031\");\n\n script_name(english:\"CentOS 7 : freerdp (CESA-2020:4031)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4031 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read\n (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read\n (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later\n (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n # https://lists.centos.org/pipermail/centos-cr-announce/2020-October/012703.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?a4c3a180\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/20.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/125.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/129.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/190.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/476.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/672.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/770.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/787.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/805.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(20, 119, 125, 129, 190, 476, 672, 770, 787, 805);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'CentOS 7.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'cpu':'i686', 'release':'CentOS-7'},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'cpu':'i686', 'release':'CentOS-7'},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'libwinpr-2.1.1-2.el7', 'cpu':'i686', 'release':'CentOS-7'},\n {'reference':'libwinpr-2.1.1-2.el7', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'cpu':'i686', 'release':'CentOS-7'},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'cpu':'x86_64', 'release':'CentOS-7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-29T19:37:39", "description": "The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-10-27T00:00:00", "type": "nessus", "title": "NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0172)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-11-27T00:00:00", "cpe": ["p-cpe:/a:zte:cgsl_core:freerdp", "p-cpe:/a:zte:cgsl_core:freerdp-devel", "p-cpe:/a:zte:cgsl_core:freerdp-libs", "p-cpe:/a:zte:cgsl_core:libwinpr", "p-cpe:/a:zte:cgsl_core:libwinpr-devel", "p-cpe:/a:zte:cgsl_main:freerdp", "p-cpe:/a:zte:cgsl_main:freerdp-devel", "p-cpe:/a:zte:cgsl_main:freerdp-libs", "p-cpe:/a:zte:cgsl_main:libwinpr", "p-cpe:/a:zte:cgsl_main:libwinpr-devel", "cpe:/o:zte:cgsl_core:5", "cpe:/o:zte:cgsl_main:5"], "id": "NEWSTART_CGSL_NS-SA-2021-0172_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/154454", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0172. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154454);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/27\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n\n script_name(english:\"NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0172)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote NewStart CGSL host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected\nby multiple vulnerabilities:\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0172\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11018\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11019\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11038\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11039\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11040\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11041\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11042\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11043\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11044\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11045\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11046\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11047\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11048\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11049\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11058\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11085\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11086\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11087\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11088\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11089\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11522\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11525\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11526\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-13396\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-13397\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/09/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_core:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_main:5\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL CORE 5.05\" &&\n release !~ \"CGSL MAIN 5.05\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nvar flag = 0;\n\nvar pkgs = {\n 'CGSL CORE 5.05': [\n 'freerdp-2.1.1-2.el7',\n 'freerdp-devel-2.1.1-2.el7',\n 'freerdp-libs-2.1.1-2.el7',\n 'libwinpr-2.1.1-2.el7',\n 'libwinpr-devel-2.1.1-2.el7'\n ],\n 'CGSL MAIN 5.05': [\n 'freerdp-2.1.1-2.el7',\n 'freerdp-devel-2.1.1-2.el7',\n 'freerdp-libs-2.1.1-2.el7',\n 'libwinpr-2.1.1-2.el7',\n 'libwinpr-devel-2.1.1-2.el7'\n ]\n};\nvar pkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:23:26", "description": "Security Fix(es) :\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)", "cvss3": {}, "published": "2020-10-21T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : freerdp on SL7.x x86_64 (20201001)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-12T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:freerdp", "p-cpe:/a:fermilab:scientific_linux:freerdp-debuginfo", "p-cpe:/a:fermilab:scientific_linux:freerdp-devel", "p-cpe:/a:fermilab:scientific_linux:freerdp-libs", "p-cpe:/a:fermilab:scientific_linux:libwinpr", "p-cpe:/a:fermilab:scientific_linux:libwinpr-devel", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20201001_FREERDP_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/141720", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(141720);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/12\");\n\n script_cve_id(\"CVE-2020-11018\", \"CVE-2020-11019\", \"CVE-2020-11038\", \"CVE-2020-11039\", \"CVE-2020-11040\", \"CVE-2020-11041\", \"CVE-2020-11042\", \"CVE-2020-11043\", \"CVE-2020-11044\", \"CVE-2020-11045\", \"CVE-2020-11046\", \"CVE-2020-11047\", \"CVE-2020-11048\", \"CVE-2020-11049\", \"CVE-2020-11058\", \"CVE-2020-11085\", \"CVE-2020-11086\", \"CVE-2020-11087\", \"CVE-2020-11088\", \"CVE-2020-11089\", \"CVE-2020-11522\", \"CVE-2020-11525\", \"CVE-2020-11526\", \"CVE-2020-13396\", \"CVE-2020-13397\");\n\n script_name(english:\"Scientific Linux Security Update : freerdp on SL7.x x86_64 (20201001)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Security Fix(es) :\n\n - freerdp: Out of bound read in\n cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read/write in usb redirection\n channel (CVE-2020-11039)\n\n - freerdp: out-of-bounds read in update_read_icon_info\n function (CVE-2020-11042)\n\n - freerdp: out-of-bounds read in\n autodetect_recv_bandwidth_measure_results function\n (CVE-2020-11047)\n\n - freerdp: Out-of-bounds read in\n ntlm_read_ChallengeMessage in\n winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in\n libfreerdp/core/security.c (CVE-2020-13397)\n\n - freerdp: Out of bound read in update_recv could result\n in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel\n (CVE-2020-11038)\n\n - freerdp: Out of bound access in\n clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in\n rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out of bound read in\n rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in\n update_read_cache_bitmap_v3_order function\n (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data\n function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize\n function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read could result in aborting the\n session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then\n passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in\n rdp_read_font_capability_set could lead to out-of-bounds\n read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list\n function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in\n ntlm_read_ntlm_v2_client_challenge function\n (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in\n ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in\n ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions\n (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in\n update_recv_secondary_order could lead out of bounds\n read later (CVE-2020-11526)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2010&L=SCIENTIFIC-LINUX-ERRATA&P=14786\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?aa03362d\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-2.1.1-2.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-debuginfo-2.1.1-2.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-devel-2.1.1-2.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-libs-2.1.1-2.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libwinpr-2.1.1-2.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libwinpr-devel-2.1.1-2.el7\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-debuginfo / freerdp-devel / freerdp-libs / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:56:42", "description": "The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-05-09T00:00:00", "type": "nessus", "title": "NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2022-0063)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4033"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:zte:cgsl_main:freerdp", "p-cpe:/a:zte:cgsl_main:freerdp-debuginfo", "p-cpe:/a:zte:cgsl_main:freerdp-debugsource", "p-cpe:/a:zte:cgsl_main:freerdp-devel", "p-cpe:/a:zte:cgsl_main:freerdp-libs", "p-cpe:/a:zte:cgsl_main:freerdp-libs-debuginfo", "p-cpe:/a:zte:cgsl_main:libwinpr", "p-cpe:/a:zte:cgsl_main:libwinpr-debuginfo", "p-cpe:/a:zte:cgsl_main:libwinpr-devel", "cpe:/o:zte:cgsl_main:6"], "id": "NEWSTART_CGSL_NS-SA-2022-0063_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/160811", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2022-0063. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(160811);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4033\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\"\n );\n\n script_name(english:\"NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2022-0063)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote NewStart CGSL host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple\nvulnerabilities:\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a\n workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in\n license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to\n an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in\n rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked\n against local surface coordinates and blindly accepted. A malicious server can send data that will crash\n the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a\n workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string\n length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based\n clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2022-0063\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11095\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11096\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11097\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11098\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11099\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-15103\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-4030\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-4033\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/05/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_main:6\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL MAIN 6.02\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nvar flag = 0;\n\nvar pkgs = {\n 'CGSL MAIN 6.02': [\n 'freerdp-2.2.0-1.el8',\n 'freerdp-debuginfo-2.2.0-1.el8',\n 'freerdp-debugsource-2.2.0-1.el8',\n 'freerdp-devel-2.2.0-1.el8',\n 'freerdp-libs-2.2.0-1.el8',\n 'freerdp-libs-debuginfo-2.2.0-1.el8',\n 'libwinpr-2.2.0-1.el8',\n 'libwinpr-debuginfo-2.2.0-1.el8',\n 'libwinpr-devel-2.2.0-1.el8'\n ]\n};\nvar pkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-19T15:00:57", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1849 advisory.\n\n - freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)\n\n - freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)\n\n - freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)\n\n - freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)\n\n - freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)\n\n - freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)\n\n - freerdp: out of bounds read in TrioParse (CVE-2020-4030)\n\n - freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-05-19T00:00:00", "type": "nessus", "title": "CentOS 8 : freerdp (CESA-2021:1849)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4033"], "modified": "2021-06-02T00:00:00", "cpe": ["cpe:/o:centos:centos:8-stream", "p-cpe:/a:centos:centos:freerdp", "p-cpe:/a:centos:centos:freerdp-devel", "p-cpe:/a:centos:centos:freerdp-libs", "p-cpe:/a:centos:centos:libwinpr", "p-cpe:/a:centos:centos:libwinpr-devel"], "id": "CENTOS8_RHSA-2021-1849.NASL", "href": "https://www.tenable.com/plugins/nessus/149733", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2021:1849. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(149733);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/06/02\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4033\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\"\n );\n script_xref(name:\"RHSA\", value:\"2021:1849\");\n\n script_name(english:\"CentOS 8 : freerdp (CESA-2021:1849)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2021:1849 advisory.\n\n - freerdp: out of bound reads resulting in accessing memory location outside of static array\n PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)\n\n - freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)\n\n - freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)\n\n - freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)\n\n - freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)\n\n - freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)\n\n - freerdp: out of bounds read in TrioParse (CVE-2020-4030)\n\n - freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:1849\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/05/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/05/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8-stream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr-devel\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif ('CentOS Stream' >!< release) audit(AUDIT_OS_NOT, 'CentOS 8-Stream');\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'freerdp-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-10T16:43:51", "description": "The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4031 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-09-07T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : freerdp (ELSA-2020-4031)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-09-07T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:freerdp", "p-cpe:/a:oracle:linux:freerdp-devel", "p-cpe:/a:oracle:linux:freerdp-libs", "p-cpe:/a:oracle:linux:libwinpr", "p-cpe:/a:oracle:linux:libwinpr-devel"], "id": "ORACLELINUX_ELSA-2020-4031.NASL", "href": "https://www.tenable.com/plugins/nessus/180977", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-4031.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(180977);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/09/07\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n\n script_name(english:\"Oracle Linux 7 : freerdp (ELSA-2020-4031)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2020-4031 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2020-4031.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/09/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(os_release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar pkgs = [\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release) {\n if (exists_check) {\n if (rpm_exists(release:_release, rpm:exists_check) && rpm_check(release:_release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:23", "description": "The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2021-0083)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-10T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2021-0083_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/147314", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0083. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147314);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/10\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n\n script_name(english:\"NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2021-0083)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple\nvulnerabilities:\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0083\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL MAIN 6.02\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nflag = 0;\n\npkgs = {\n 'CGSL MAIN 6.02': [\n 'freerdp-2.1.1-1.el8',\n 'freerdp-debuginfo-2.1.1-1.el8',\n 'freerdp-debugsource-2.1.1-1.el8',\n 'freerdp-devel-2.1.1-1.el8',\n 'freerdp-libs-2.1.1-1.el8',\n 'freerdp-libs-debuginfo-2.1.1-1.el8',\n 'libwinpr-2.1.1-1.el8',\n 'libwinpr-debuginfo-2.1.1-1.el8',\n 'libwinpr-devel-2.1.1-1.el8'\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-12T13:34:42", "description": "The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4647 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-11-06T00:00:00", "type": "nessus", "title": "Rocky Linux 8 : freerdp and vinagre (RLSA-2020:4647)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-11-06T00:00:00", "cpe": ["p-cpe:/a:rocky:linux:vinagre-debuginfo", "p-cpe:/a:rocky:linux:vinagre-debugsource", "p-cpe:/a:rocky:linux:vinagre", "cpe:/o:rocky:linux:8"], "id": "ROCKY_LINUX_RLSA-2020-4647.NASL", "href": "https://www.tenable.com/plugins/nessus/184677", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# Rocky Linux Security Advisory RLSA-2020:4647.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(184677);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/06\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"RLSA\", value:\"2020:4647\");\n\n script_name(english:\"Rocky Linux 8 : freerdp and vinagre (RLSA-2020:4647)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Rocky Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nRLSA-2020:4647 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.rockylinux.org/RLSA-2020:4647\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1761144\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1803054\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1834287\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835391\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835399\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835403\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835762\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835772\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1835779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1836223\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1836239\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1836247\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1839744\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1841189\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1841196\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1844161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1844166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1844171\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1844177\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1844184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848012\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848022\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848029\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848034\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1848038\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected vinagre, vinagre-debuginfo and / or vinagre-debugsource packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/11/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:vinagre\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:vinagre-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:vinagre-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:rocky:linux:8\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Rocky Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RockyLinux/release\", \"Host/RockyLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RockyLinux/release');\nif (isnull(os_release) || 'Rocky Linux' >!< os_release) audit(AUDIT_OS_NOT, 'Rocky Linux');\nvar os_ver = pregmatch(pattern: \"Rocky(?: Linux)? release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 8.x', 'Rocky Linux ' + os_ver);\n\nif (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);\n\nvar pkgs = [\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-debuginfo-3.22.0-23.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-debuginfo-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-debugsource-3.22.0-23.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-debugsource-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'Rocky-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'vinagre / vinagre-debuginfo / vinagre-debugsource');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:25:08", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4647 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-11-04T00:00:00", "type": "nessus", "title": "RHEL 8 : freerdp and vinagre (RHSA-2020:4647)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel", "p-cpe:/a:redhat:enterprise_linux:vinagre"], "id": "REDHAT-RHSA-2020-4647.NASL", "href": "https://www.tenable.com/plugins/nessus/142401", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4647. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142401);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4647\");\n\n script_name(english:\"RHEL 8 : freerdp and vinagre (RHSA-2020:4647)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:4647 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read\n (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read\n (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later\n (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11038\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11039\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11040\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11041\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11043\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11044\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11045\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11047\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11048\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11085\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11087\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11088\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11089\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11522\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11525\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13396\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-13397\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4647\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835391\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835399\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835403\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835762\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835772\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1835779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836223\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836239\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836247\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1841189\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1841196\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844171\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844177\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1844184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848012\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848022\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848029\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848034\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1848038\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(20, 119, 125, 129, 190, 476, 672, 770, 787, 805);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vinagre\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/appstream/debug',\n 'content/e4s/rhel8/8.4/aarch64/appstream/os',\n 'content/e4s/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/baseos/debug',\n 'content/e4s/rhel8/8.4/aarch64/baseos/os',\n 'content/e4s/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/appstream/debug',\n 'content/e4s/rhel8/8.4/s390x/appstream/os',\n 'content/e4s/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/baseos/debug',\n 'content/e4s/rhel8/8.4/s390x/baseos/os',\n 'content/e4s/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/nfv/debug',\n 'content/e4s/rhel8/8.4/x86_64/nfv/os',\n 'content/e4s/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.1.1-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'vinagre-3.22.0-23.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.1.1-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'vinagre-3.22.0-23.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.1.1-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.1.1-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'vinagre-3.22.0-23.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-19T15:00:55", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1849 advisory.\n\n - freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)\n\n - freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)\n\n - freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)\n\n - freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)\n\n - freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)\n\n - freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)\n\n - freerdp: out of bounds read in TrioParse (CVE-2020-4030)\n\n - freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-05-19T00:00:00", "type": "nessus", "title": "RHEL 8 : freerdp (RHSA-2021:1849)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4033"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel"], "id": "REDHAT-RHSA-2021-1849.NASL", "href": "https://www.tenable.com/plugins/nessus/149700", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:1849. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(149700);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4033\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\"\n );\n script_xref(name:\"RHSA\", value:\"2021:1849\");\n\n script_name(english:\"RHEL 8 : freerdp (RHSA-2021:1849)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:1849 advisory.\n\n - freerdp: out of bound reads resulting in accessing memory location outside of static array\n PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)\n\n - freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)\n\n - freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)\n\n - freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)\n\n - freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)\n\n - freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)\n\n - freerdp: out of bounds read in TrioParse (CVE-2020-4030)\n\n - freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-4030\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-4033\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11096\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11097\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11098\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11099\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15103\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:1849\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854843\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854850\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854876\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854899\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1854910\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1858909\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 122, 125, 129, 190, 805);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/05/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/05/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/appstream/debug',\n 'content/e4s/rhel8/8.4/aarch64/appstream/os',\n 'content/e4s/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/baseos/debug',\n 'content/e4s/rhel8/8.4/aarch64/baseos/os',\n 'content/e4s/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/appstream/debug',\n 'content/e4s/rhel8/8.4/s390x/appstream/os',\n 'content/e4s/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/baseos/debug',\n 'content/e4s/rhel8/8.4/s390x/baseos/os',\n 'content/e4s/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/nfv/debug',\n 'content/e4s/rhel8/8.4/x86_64/nfv/os',\n 'content/e4s/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.2.0-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.2.0-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.2.0-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:55:21", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1849 advisory.\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-05-26T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : freerdp (ELSA-2021-1849)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4033"], "modified": "2021-05-26T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:freerdp", "p-cpe:/a:oracle:linux:freerdp-devel", "p-cpe:/a:oracle:linux:freerdp-libs", "p-cpe:/a:oracle:linux:libwinpr", "p-cpe:/a:oracle:linux:libwinpr-devel"], "id": "ORACLELINUX_ELSA-2021-1849.NASL", "href": "https://www.tenable.com/plugins/nessus/149961", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2021-1849.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(149961);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/05/26\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4033\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\"\n );\n\n script_name(english:\"Oracle Linux 8 : freerdp (ELSA-2021-1849)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2021-1849 advisory.\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string\n length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based\n clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a\n workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in\n license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to\n an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in\n rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked\n against local surface coordinates and blindly accepted. A malicious server can send data that will crash\n the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a\n workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2021-1849.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/05/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/05/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr-devel\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\npkgs = [\n {'reference':'freerdp-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:52:11", "description": "The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1849 advisory.\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-02-09T00:00:00", "type": "nessus", "title": "AlmaLinux 8 : freerdp (ALSA-2021:1849)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4033"], "modified": "2022-02-14T00:00:00", "cpe": ["p-cpe:/a:alma:linux:freerdp-devel", "cpe:/o:alma:linux:8"], "id": "ALMA_LINUX_ALSA-2021-1849.NASL", "href": "https://www.tenable.com/plugins/nessus/157588", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# AlmaLinux Security Advisory ALSA-2021:1849.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(157588);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/02/14\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4033\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-15103\"\n );\n script_xref(name:\"ALSA\", value:\"2021:1849\");\n\n script_name(english:\"AlmaLinux 8 : freerdp (ALSA-2021:1849)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote AlmaLinux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the\nALSA-2021:1849 advisory.\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string\n length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based\n clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a\n workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in\n license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to\n an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in\n rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked\n against local surface coordinates and blindly accepted. A malicious server can send data that will crash\n the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a\n workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.almalinux.org/8/ALSA-2021-1849.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp-devel package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-4033\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/05/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/02/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Alma Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AlmaLinux/release\", \"Host/AlmaLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/AlmaLinux/release');\nif (isnull(release) || 'AlmaLinux' >!< release) audit(AUDIT_OS_NOT, 'AlmaLinux');\nvar os_ver = pregmatch(pattern: \"AlmaLinux release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'AlmaLinux 8.x', 'AlmaLinux ' + os_ver);\n\nif (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);\n\nvar pkgs = [\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.2.0-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'Alma-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-19T14:54:11", "description": "According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.(CVE-2020-11098)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.(CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.(CVE-2020-4033)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.(CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.(CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.(CVE-2020-13397)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.(CVE-2020-11046)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-09-28T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP3 : freerdp (EulerOS-SA-2020-2064)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11046", "CVE-2020-11089", "CVE-2020-11098", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-4033"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:freerdp", "p-cpe:/a:huawei:euleros:freerdp-libs", "p-cpe:/a:huawei:euleros:freerdp-plugins", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-2064.NASL", "href": "https://www.tenable.com/plugins/nessus/140831", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(140831);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2020-11046\",\n \"CVE-2020-11089\",\n \"CVE-2020-11098\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\",\n \"CVE-2020-4033\"\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : freerdp (EulerOS-SA-2020-2064)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the freerdp packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - In FreeRDP before version 2.1.2, there is an\n out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This\n is fixed in version 2.1.2.(CVE-2020-11098)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read\n in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write,\n printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in\n 2.1.0.(CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, there is an out of\n bounds read in RLEDECOMPRESS. All FreeRDP based clients\n with sessions with color depth < 32 are affected. This\n is fixed in version 2.1.2.(CVE-2020-4033)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4\n has an Out-of-bounds Read.(CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0\n through 2.0.0-rc4 has an Out of bounds\n read.(CVE-2020-11525)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in\n libfreerdp/core/security.c due to an uninitialized\n value.(CVE-2020-13397)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a\n stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds\n read.(CVE-2020-11046)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in\n libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2064\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f21505e2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"freerdp-1.0.2-6.1.h9\",\n \"freerdp-libs-1.0.2-6.1.h9\",\n \"freerdp-plugins-1.0.2-6.1.h9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-11T15:32:29", "description": "The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4647 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-02-09T00:00:00", "type": "nessus", "title": "AlmaLinux 8 : freerdp and vinagre (ALSA-2020:4647)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2023-11-10T00:00:00", "cpe": ["p-cpe:/a:alma:linux:freerdp-devel", "p-cpe:/a:alma:linux:vinagre", "cpe:/o:alma:linux:8"], "id": "ALMA_LINUX_ALSA-2020-4647.NASL", "href": "https://www.tenable.com/plugins/nessus/157652", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# AlmaLinux Security Advisory ALSA-2020:4647.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(157652);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/10\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"ALSA\", value:\"2020:4647\");\n\n script_name(english:\"AlmaLinux 8 : freerdp and vinagre (ALSA-2020:4647)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote AlmaLinux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nALSA-2020:4647 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.almalinux.org/8/ALSA-2020-4647.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp-devel and / or vinagre packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/02/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:vinagre\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Alma Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AlmaLinux/release\", \"Host/AlmaLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/AlmaLinux/release');\nif (isnull(release) || 'AlmaLinux' >!< release) audit(AUDIT_OS_NOT, 'AlmaLinux');\nvar os_ver = pregmatch(pattern: \"AlmaLinux release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'AlmaLinux 8.x', 'AlmaLinux ' + os_ver);\n\nif (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);\n\nvar pkgs = [\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'Alma-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp-devel / vinagre');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:23:56", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4647 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-02-01T00:00:00", "type": "nessus", "title": "CentOS 8 : freerdp and vinagre (CESA-2020:4647)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397"], "modified": "2022-05-10T00:00:00", "cpe": ["cpe:/o:centos:centos:8", "p-cpe:/a:centos:centos:freerdp", "p-cpe:/a:centos:centos:freerdp-devel", "p-cpe:/a:centos:centos:freerdp-libs", "p-cpe:/a:centos:centos:libwinpr", "p-cpe:/a:centos:centos:libwinpr-devel", "p-cpe:/a:centos:centos:vinagre"], "id": "CENTOS8_RHSA-2020-4647.NASL", "href": "https://www.tenable.com/plugins/nessus/146026", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2020:4647. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146026);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/10\");\n\n script_cve_id(\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4647\");\n\n script_name(english:\"CentOS 8 : freerdp and vinagre (CESA-2020:4647)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4647 advisory.\n\n - freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)\n\n - freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)\n\n - freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)\n\n - freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)\n\n - freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)\n\n - freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)\n\n - freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)\n\n - freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)\n\n - freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)\n\n - freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)\n\n - freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read\n (CVE-2020-11046)\n\n - freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)\n\n - freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)\n\n - freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)\n\n - freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read\n (CVE-2020-11058)\n\n - freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)\n\n - freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)\n\n - freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)\n\n - freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)\n\n - freerdp: out-of-bounds read in irp functions (CVE-2020-11089)\n\n - freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)\n\n - freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)\n\n - freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later\n (CVE-2020-11526)\n\n - freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n (CVE-2020-13396)\n\n - freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4647\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-13396\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:vinagre\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif ('CentOS Stream' >< release) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS Stream ' + os_ver);\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'freerdp-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.1.1-1.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'vinagre-3.22.0-23.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:00:27", "description": "The remote host is affected by the vulnerability described in GLSA-202005-07 (FreeRDP: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in FreeRDP. Please review the CVE identifiers referenced below for details.\n Impact :\n\n An attacker could possibly cause a Denial of Service condition.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2020-05-15T00:00:00", "type": "nessus", "title": "GLSA-202005-07 : FreeRDP: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-17177", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526"], "modified": "2022-05-16T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:freerdp", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-202005-07.NASL", "href": "https://www.tenable.com/plugins/nessus/136637", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202005-07.\n#\n# The advisory text is Copyright (C) 2001-2022 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136637);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/16\");\n\n script_cve_id(\"CVE-2019-17177\", \"CVE-2020-11521\", \"CVE-2020-11522\", \"CVE-2020-11523\", \"CVE-2020-11524\", \"CVE-2020-11525\", \"CVE-2020-11526\");\n script_xref(name:\"GLSA\", value:\"202005-07\");\n\n script_name(english:\"GLSA-202005-07 : FreeRDP: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202005-07\n(FreeRDP: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in FreeRDP. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n An attacker could possibly cause a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202005-07\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All FreeRDP users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/freerdp-2.1.0'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11522\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/freerdp\", unaffected:make_list(\"ge 2.1.0\"), vulnerable:make_list(\"lt 2.1.0\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"FreeRDP\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-29T19:36:39", "description": "The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11524)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-10-27T00:00:00", "type": "nessus", "title": "NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0143)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-13398"], "modified": "2023-11-27T00:00:00", "cpe": ["p-cpe:/a:zte:cgsl_core:freerdp", "p-cpe:/a:zte:cgsl_core:freerdp-debuginfo", "p-cpe:/a:zte:cgsl_core:freerdp-devel", "p-cpe:/a:zte:cgsl_core:freerdp-libs", "p-cpe:/a:zte:cgsl_core:libwinpr", "p-cpe:/a:zte:cgsl_core:libwinpr-devel", "p-cpe:/a:zte:cgsl_main:freerdp", "p-cpe:/a:zte:cgsl_main:freerdp-debuginfo", "p-cpe:/a:zte:cgsl_main:freerdp-devel", "p-cpe:/a:zte:cgsl_main:freerdp-libs", "p-cpe:/a:zte:cgsl_main:libwinpr", "p-cpe:/a:zte:cgsl_main:libwinpr-devel", "cpe:/o:zte:cgsl_core:5", "cpe:/o:zte:cgsl_main:5"], "id": "NEWSTART_CGSL_NS-SA-2021-0143_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/154493", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0143. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154493);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/27\");\n\n script_cve_id(\n \"CVE-2020-11521\",\n \"CVE-2020-11523\",\n \"CVE-2020-11524\",\n \"CVE-2020-13398\"\n );\n\n script_name(english:\"NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0143)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote NewStart CGSL host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected\nby multiple vulnerabilities:\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11524)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0143\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11521\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11523\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-11524\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-13398\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/09/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_core:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_core:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_main:5\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL CORE 5.05\" &&\n release !~ \"CGSL MAIN 5.05\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nvar flag = 0;\n\nvar pkgs = {\n 'CGSL CORE 5.05': [\n 'freerdp-2.0.0-4.rc4.el7_8.1',\n 'freerdp-debuginfo-2.0.0-4.rc4.el7_8.1',\n 'freerdp-devel-2.0.0-4.rc4.el7_8.1',\n 'freerdp-libs-2.0.0-4.rc4.el7_8.1',\n 'libwinpr-2.0.0-4.rc4.el7_8.1',\n 'libwinpr-devel-2.0.0-4.rc4.el7_8.1'\n ],\n 'CGSL MAIN 5.05': [\n 'freerdp-2.0.0-4.rc4.el7_8.1',\n 'freerdp-debuginfo-2.0.0-4.rc4.el7_8.1',\n 'freerdp-devel-2.0.0-4.rc4.el7_8.1',\n 'freerdp-libs-2.0.0-4.rc4.el7_8.1',\n 'libwinpr-2.0.0-4.rc4.el7_8.1',\n 'libwinpr-devel-2.0.0-4.rc4.el7_8.1'\n ]\n};\nvar pkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-18T14:55:26", "description": "According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.(CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.(CVE-2020-4033)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.(CVE-2020-11089)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-07-30T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2020-1801)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11089", "CVE-2020-11098", "CVE-2020-13398", "CVE-2020-4033"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:freerdp", "p-cpe:/a:huawei:euleros:freerdp-libs", "p-cpe:/a:huawei:euleros:libwinpr", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1801.NASL", "href": "https://www.tenable.com/plugins/nessus/139131", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(139131);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2020-11089\",\n \"CVE-2020-11098\",\n \"CVE-2020-13398\",\n \"CVE-2020-4033\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2020-1801)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the freerdp packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - In FreeRDP before version 2.1.2, there is an\n out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This\n is fixed in version 2.1.2.(CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of\n bounds read in RLEDECOMPRESS. All FreeRDP based clients\n with sessions with color depth < 32 are affected. This\n is fixed in version 2.1.2.(CVE-2020-4033)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read\n in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write,\n printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in\n 2.1.0.(CVE-2020-11089)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in\n libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1801\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?a957e008\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/07/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"freerdp-2.0.0-44.rc3.h7.eulerosv2r8\",\n \"freerdp-libs-2.0.0-44.rc3.h7.eulerosv2r8\",\n \"libwinpr-2.0.0-44.rc3.h7.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-08T21:29:42", "description": "The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3606 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0. (CVE-2020-11017)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. (CVE-2020-4031)\n\n - In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order.\n All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.\n (CVE-2020-4032)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39350)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39352)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39353)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out- Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.\n There are no known workarounds for this vulnerability. (CVE-2023-39354)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is 0, `context->planesBuffer` will be freed. However, without updating `context->planesBuffer`, this leads to a Use-After-Free exploit vector.\n In most environments this should only result in a crash. This issue has been addressed in version 3.0.0-beta3 and users of the beta 3.x releases are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39355)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash.\n This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39356)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40181)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40186)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out- Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40188)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. (CVE-2023-40567)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. (CVE-2023-40569)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40589)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-10-08T00:00:00", "type": "nessus", "title": "Debian DLA-3606-1 : freerdp2 - LTS security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11017", "CVE-2020-11018", "CVE-2020-11019", "CVE-2020-11038", "CVE-2020-11039", "CVE-2020-11040", "CVE-2020-11041", "CVE-2020-11042", "CVE-2020-11043", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11085", "CVE-2020-11086", "CVE-2020-11087", "CVE-2020-11088", "CVE-2020-11089", "CVE-2020-11095", "CVE-2020-11096", "CVE-2020-11097", "CVE-2020-11098", "CVE-2020-11099", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398", "CVE-2020-15103", "CVE-2020-4030", "CVE-2020-4031", "CVE-2020-4032", "CVE-2020-4033", "CVE-2023-39350", "CVE-2023-39351", "CVE-2023-39352", "CVE-2023-39353", "CVE-2023-39354", "CVE-2023-39355", "CVE-2023-39356", "CVE-2023-40181", "CVE-2023-40186", "CVE-2023-40188", "CVE-2023-40567", "CVE-2023-40569", "CVE-2023-40589"], "modified": "2023-10-08T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:10.0", "p-cpe:/a:debian:debian_linux:freerdp2-dev", "p-cpe:/a:debian:debian_linux:freerdp2-shadow-x11", "p-cpe:/a:debian:debian_linux:freerdp2-wayland", "p-cpe:/a:debian:debian_linux:freerdp2-x11", "p-cpe:/a:debian:debian_linux:libfreerdp-client2-2", "p-cpe:/a:debian:debian_linux:libfreerdp-server2-2", "p-cpe:/a:debian:debian_linux:libfreerdp-shadow-subsystem2-2", "p-cpe:/a:debian:debian_linux:libfreerdp-shadow2-2", "p-cpe:/a:debian:debian_linux:libfreerdp2-2", "p-cpe:/a:debian:debian_linux:libuwac0-0", "p-cpe:/a:debian:debian_linux:libuwac0-dev", "p-cpe:/a:debian:debian_linux:libwinpr-tools2-2", "p-cpe:/a:debian:debian_linux:libwinpr2-2", "p-cpe:/a:debian:debian_linux:libwinpr2-dev", "p-cpe:/a:debian:debian_linux:winpr-utils"], "id": "DEBIAN_DLA-3606.NASL", "href": "https://www.tenable.com/plugins/nessus/182754", "sourceData": "#%NASL_MIN_LEVEL 80900\n#\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory dla-3606. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(182754);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/08\");\n\n script_cve_id(\n \"CVE-2020-4030\",\n \"CVE-2020-4031\",\n \"CVE-2020-4032\",\n \"CVE-2020-4033\",\n \"CVE-2020-11017\",\n \"CVE-2020-11018\",\n \"CVE-2020-11019\",\n \"CVE-2020-11038\",\n \"CVE-2020-11039\",\n \"CVE-2020-11040\",\n \"CVE-2020-11041\",\n \"CVE-2020-11042\",\n \"CVE-2020-11043\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11085\",\n \"CVE-2020-11086\",\n \"CVE-2020-11087\",\n \"CVE-2020-11088\",\n \"CVE-2020-11089\",\n \"CVE-2020-11095\",\n \"CVE-2020-11096\",\n \"CVE-2020-11097\",\n \"CVE-2020-11098\",\n \"CVE-2020-11099\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\",\n \"CVE-2020-15103\",\n \"CVE-2023-39350\",\n \"CVE-2023-39351\",\n \"CVE-2023-39352\",\n \"CVE-2023-39353\",\n \"CVE-2023-39354\",\n \"CVE-2023-39355\",\n \"CVE-2023-39356\",\n \"CVE-2023-40181\",\n \"CVE-2023-40186\",\n \"CVE-2023-40188\",\n \"CVE-2023-40567\",\n \"CVE-2023-40569\",\n \"CVE-2023-40589\"\n );\n\n script_name(english:\"Debian DLA-3606-1 : freerdp2 - LTS security update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Debian host is missing one or more security-related updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the\ndla-3606 advisory.\n\n - In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a\n double free condition and crash the server. This is fixed in version 2.1.0. (CVE-2020-11017)\n\n - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.\n Malicious clients could trigger out of bound reads causing memory allocation with random size. This has\n been fixed in 2.1.0. (CVE-2020-11018)\n\n - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of\n application could occur due to a read of an invalid array index. Data could be printed as string to local\n terminal. This has been fixed in 2.1.0. (CVE-2020-11019)\n\n - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video\n redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than\n requested due to an integer overflow in size calculation. With later messages, the server can manipulate\n the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.\n (CVE-2020-11038)\n\n - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled\n (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been\n patched in 2.1.0. (CVE-2020-11039)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in\n clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.\n (CVE-2020-11040)\n\n - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used\n as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the\n client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the\n patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.\n (CVE-2020-11041)\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.\n Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.\n (CVE-2020-11043)\n\n - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes\n the client application if corrupted data from a manipulated server is parsed. This has been patched in\n 2.0.0. (CVE-2020-11044)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in\n autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory\n with a manipulated message by providing a short input and reading the measurement result data. This has\n been patched in 2.0.0. (CVE-2020-11047)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed\n on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data\n read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in\n ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This\n has been fixed in 2.1.0. (CVE-2020-11086)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.\n This has been fixed in 2.1.0. (CVE-2020-11087)\n\n - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This\n has been fixed in 2.1.0. (CVE-2020-11088)\n\n - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,\n serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,\n serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)\n\n - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11095)\n\n - In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a\n workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.\n (CVE-2020-11096)\n\n - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location\n that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in\n version 2.1.2. (CVE-2020-11097)\n\n - In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all\n FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2. (CVE-2020-11098)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in\n license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to\n an internal buffer. This is fixed in version 2.1.2. (CVE-2020-11099)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\n - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in\n rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked\n against local surface coordinates and blindly accepted. A malicious server can send data that will crash\n the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a\n workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto (CVE-2020-15103)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string\n length checks due to an integer overflow. This is fixed in version 2.1.2. (CVE-2020-4030)\n\n - In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using\n compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. (CVE-2020-4031)\n\n - In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order.\n All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.\n (CVE-2020-4032)\n\n - In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based\n clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2. (CVE-2020-4033)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with\n default compilation flags). When an insufficient blockLen is provided, and proper length validation is not\n performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has\n been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known\n workarounds for this vulnerability. (CVE-2023-39350)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX\n (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using\n `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed\n for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would\n cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised\n to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be\n triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and\n `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice\n this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are\n advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39352)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the\n `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and\n `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will\n cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to\n upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39353)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-\n Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of\n sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a\n crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.\n There are no known workarounds for this vulnerability. (CVE-2023-39354)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing\n `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is 0, `context->planesBuffer` will be\n freed. However, without updating `context->planesBuffer`, this leads to a Use-After-Free exploit vector.\n In most environments this should only result in a crash. This issue has been addressed in version\n 3.0.0-beta3 and users of the beta 3.x releases are advised to upgrade. There are no known workarounds for\n this vulnerability. (CVE-2023-39355)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n In affected versions a missing offset validation may lead to an Out Of Bound Read in the function\n `gdi_multi_opaque_rect`. In particular there is no code to validate if the value\n `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles\n without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash.\n This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are\n no known workarounds for this vulnerability. (CVE-2023-39356)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the\n `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the\n transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and\n 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40181)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the\n `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not\n affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and\n 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2023-40186)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-\n Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data\n of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has\n been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known\n workarounds for this issue. (CVE-2023-40188)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in\n which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This\n issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no\n known workarounds for this vulnerability. (CVE-2023-40567)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This\n issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been\n addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds\n for this vulnerability. (CVE-2023-40569)\n\n - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.\n In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted\n input into this function can trigger the overflow which has only been shown to cause a crash. This issue\n has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known\n workarounds for this issue. (CVE-2023-40589)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965979\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/source-package/freerdp2\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.debian.org/lts/security/2023/dla-3606\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11017\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11038\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11039\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11040\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11041\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11043\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11044\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11045\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11047\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11048\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11085\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11087\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11088\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11089\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11096\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11097\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11098\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-11099\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-13396\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-13397\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-13398\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-15103\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-4030\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-4031\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-4032\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2020-4033\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39350\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39351\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39352\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39353\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39354\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39355\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-39356\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40181\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40186\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40188\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40567\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40569\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2023-40589\");\n script_set_attribute(attribute:\"see_also\", value:\"https://packages.debian.org/source/buster/freerdp2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the freerdp2 packages.\n\nFor Debian 10 buster, these problems have been fixed in version 2.3.0+dfsg1-2+deb10u3.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2023-40569\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2023/10/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp2-shadow-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp2-wayland\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp2-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-client2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-server2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-shadow-subsystem2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-shadow2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libuwac0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libuwac0-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-tools2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:winpr-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:10.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Debian Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar debian_release = get_kb_item('Host/Debian/release');\nif ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');\ndebian_release = chomp(debian_release);\nif (! preg(pattern:\"^(10)\\.[0-9]+\", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 10.0', 'Debian ' + debian_release);\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);\n\nvar pkgs = [\n {'release': '10.0', 'prefix': 'freerdp2-dev', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'freerdp2-shadow-x11', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'freerdp2-wayland', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'freerdp2-x11', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libfreerdp-client2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libfreerdp-server2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libfreerdp-shadow-subsystem2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libfreerdp-shadow2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libfreerdp2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libuwac0-0', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libuwac0-dev', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libwinpr-tools2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libwinpr2-2', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'libwinpr2-dev', 'reference': '2.3.0+dfsg1-2+deb10u3'},\n {'release': '10.0', 'prefix': 'winpr-utils', 'reference': '2.3.0+dfsg1-2+deb10u3'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var _release = NULL;\n var prefix = NULL;\n var reference = NULL;\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (_release && prefix && reference) {\n if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : deb_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = deb_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp2-dev / freerdp2-shadow-x11 / freerdp2-wayland / freerdp2-x11 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-21T15:39:44", "description": "The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4382-2 advisory.\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-11-26T00:00:00", "type": "nessus", "title": "Ubuntu 18.04 LTS : FreeRDP vulnerabilities (USN-4382-2)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11042", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11048", "CVE-2020-11058", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398"], "modified": "2023-10-21T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:freerdp-x11", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-cache1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-codec1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-common1.1.0", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-core1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-crypto1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-dev", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-gdi1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-locale1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-plugins-standard", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-primitives1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-rail1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-utils1.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-asn1-0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-bcrypt0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-credentials0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-credui0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-crt0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-crypto0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-dev", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-dsparse0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-environment0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-error0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-file0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-handle0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-heap0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-input0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-interlocked0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-io0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-library0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-path0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-pipe0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-pool0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-registry0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-rpc0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspi0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspicli0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-synch0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sysinfo0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-thread0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-timezone0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-utils0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-winhttp0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-winsock0.1", "p-cpe:/a:canonical:ubuntu_linux:libxfreerdp-client1.1"], "id": "UBUNTU_USN-4382-2.NASL", "href": "https://www.tenable.com/plugins/nessus/143270", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4382-2. The text\n# itself is copyright (C) Canonical, Inc. See\n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered\n# trademark of Canonical, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(143270);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/21\");\n\n script_cve_id(\n \"CVE-2020-11042\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11048\",\n \"CVE-2020-11058\",\n \"CVE-2020-11521\",\n \"CVE-2020-11522\",\n \"CVE-2020-11523\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\"\n );\n script_xref(name:\"USN\", value:\"4382-2\");\n\n script_name(english:\"Ubuntu 18.04 LTS : FreeRDP vulnerabilities (USN-4382-2)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe USN-4382-2 advisory.\n\n - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It\n allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate\n buffer. This can be used to crash the client or store information for later retrieval. This has been\n patched in 2.0.0. (CVE-2020-11042)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that\n allows client memory to be read to an image buffer. The result displayed on screen as colour.\n (CVE-2020-11045)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds read. (CVE-2020-11046)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.\n No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)\n\n - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could\n lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect\n due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.\n (CVE-2020-11525)\n\n - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.\n (CVE-2020-11526)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been\n detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n (CVE-2020-13397)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4382-2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-cache1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-codec1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-common1.1.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-core1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-crypto1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-gdi1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-locale1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-plugins-standard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-primitives1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-rail1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-utils1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-asn1-0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-bcrypt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-credentials0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-credui0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-crt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-crypto0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-dsparse0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-environment0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-error0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-file0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-handle0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-heap0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-input0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-interlocked0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-io0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-library0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-path0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-pipe0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-pool0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-registry0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-rpc0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspi0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspicli0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-synch0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sysinfo0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-thread0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-timezone0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-utils0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-winhttp0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-winsock0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxfreerdp-client1.1\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('18.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 18.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '18.04', 'pkgname': 'freerdp-x11', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-cache1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-client1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-codec1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-common1.1.0', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-core1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-crypto1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-dev', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-gdi1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-locale1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-plugins-standard', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-primitives1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-rail1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libfreerdp-utils1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-asn1-0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-bcrypt0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-credentials0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-credui0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-crt0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-crypto0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-dev', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-dsparse0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-environment0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-error0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-file0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-handle0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-heap0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-input0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-interlocked0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-io0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-library0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-path0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-pipe0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-pool0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-registry0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-rpc0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-sspi0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-sspicli0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-synch0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-sysinfo0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-thread0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-timezone0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-utils0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-winhttp0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libwinpr-winsock0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'},\n {'osver': '18.04', 'pkgname': 'libxfreerdp-client1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp-x11 / libfreerdp-cache1.1 / libfreerdp-client1.1 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:52:17", "description": "According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.(CVE-2020-13397)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.(CVE-2020-11525)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.(CVE-2020-11522)\n\n - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.(CVE-2020-11046)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-09-02T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : freerdp (EulerOS-SA-2020-1917)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11046", "CVE-2020-11522", "CVE-2020-11525", "CVE-2020-13397", "CVE-2020-13398"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:freerdp", "p-cpe:/a:huawei:euleros:freerdp-libs", "p-cpe:/a:huawei:euleros:freerdp-plugins", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1917.NASL", "href": "https://www.tenable.com/plugins/nessus/140138", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(140138);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2020-11046\",\n \"CVE-2020-11522\",\n \"CVE-2020-11525\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\"\n );\n\n script_name(english:\"EulerOS 2.0 SP5 : freerdp (EulerOS-SA-2020-1917)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the freerdp packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Unauthenticated Stored XSS in osTicket 1.10.1 allows a\n remote attacker to gain admin privileges by injecting\n arbitrary web script or HTML via arbitrary file\n extension while creating a support\n ticket.(CVE-2020-13397)\n\n - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0\n through 2.0.0-rc4 has an Out of bounds\n read.(CVE-2020-11525)\n\n - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4\n has an Out-of-bounds Read.(CVE-2020-11522)\n\n - An issue was discovered in FreeRDP before 2.1.1. An\n out-of-bounds (OOB) write vulnerability has been\n detected in crypto_rsa_common in\n libfreerdp/crypto/crypto.c.(CVE-2020-13398)\n\n - In FreeRDP after 1.0 and before 2.0.0, there is a\n stream out-of-bounds seek in update_read_synchronize\n that could lead to a later out-of-bounds\n read.(CVE-2020-11046)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1917\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2b2d346f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:freerdp-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"freerdp-1.0.2-15.h6.eulerosv2r7\",\n \"freerdp-libs-1.0.2-15.h6.eulerosv2r7\",\n \"freerdp-plugins-1.0.2-15.h6.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:03:22", "description": "From Red Hat Security Advisory 2020:2334 :\n\nThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2334 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-06-05T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : freerdp (ELSA-2020-2334)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2022-01-26T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:freerdp", "p-cpe:/a:oracle:linux:freerdp-devel", "p-cpe:/a:oracle:linux:freerdp-libs", "p-cpe:/a:oracle:linux:libwinpr", "p-cpe:/a:oracle:linux:libwinpr-devel", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2020-2334.NASL", "href": "https://www.tenable.com/plugins/nessus/137171", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2334 and \n# Oracle Linux Security Advisory ELSA-2020-2334 respectively.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137171);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/01/26\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2334\");\n\n script_name(english:\"Oracle Linux 7 : freerdp (ELSA-2020-2334)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"From Red Hat Security Advisory 2020:2334 :\n\nThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2334 advisory.\n\n - freerdp: Out-of-bounds write in planar.c\n (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c\n (CVE-2020-11524)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://oss.oracle.com/pipermail/el-errata/2020-June/009996.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"freerdp-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"freerdp-devel-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"freerdp-libs-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libwinpr-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libwinpr-devel-2.0.0-4.rc4.el7_8\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:02:54", "description": "From Red Hat Security Advisory 2020:2336 :\n\nThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2336 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-06-08T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : freerdp (ELSA-2020-2336)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2022-01-26T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:freerdp", "p-cpe:/a:oracle:linux:freerdp-devel", "p-cpe:/a:oracle:linux:freerdp-libs", "p-cpe:/a:oracle:linux:libwinpr", "p-cpe:/a:oracle:linux:libwinpr-devel", "cpe:/o:oracle:linux:8"], "id": "ORACLELINUX_ELSA-2020-2336.NASL", "href": "https://www.tenable.com/plugins/nessus/137218", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2336 and \n# Oracle Linux Security Advisory ELSA-2020-2336 respectively.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137218);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/01/26\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2336\");\n\n script_name(english:\"Oracle Linux 8 : freerdp (ELSA-2020-2336)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"From Red Hat Security Advisory 2020:2336 :\n\nThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2336 advisory.\n\n - freerdp: Out-of-bounds write in planar.c\n (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c\n (CVE-2020-11524)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://oss.oracle.com/pipermail/el-errata/2020-June/010005.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected freerdp packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 8\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL8\", cpu:\"x86_64\", reference:\"freerdp-2.0.0-46.rc4.el8_2.1\")) flag++;\nif (rpm_check(release:\"EL8\", cpu:\"x86_64\", reference:\"freerdp-devel-2.0.0-46.rc4.el8_2.1\")) flag++;\nif (rpm_check(release:\"EL8\", cpu:\"x86_64\", reference:\"freerdp-libs-2.0.0-46.rc4.el8_2.1\")) flag++;\nif (rpm_check(release:\"EL8\", cpu:\"x86_64\", reference:\"libwinpr-2.0.0-46.rc4.el8_2.1\")) flag++;\nif (rpm_check(release:\"EL8\", cpu:\"x86_64\", reference:\"libwinpr-devel-2.0.0-46.rc4.el8_2.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:20:44", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2354 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-06-03T00:00:00", "type": "nessus", "title": "RHEL 8 : freerdp (RHSA-2020:2354)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_e4s:8.1", "cpe:/o:redhat:rhel_eus:8.1", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel"], "id": "REDHAT-RHSA-2020-2354.NASL", "href": "https://www.tenable.com/plugins/nessus/137059", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2354. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137059);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2354\");\n\n script_name(english:\"RHEL 8 : freerdp (RHSA-2020:2354)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2354 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:2354\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836214\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836226\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836234\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(125, 190);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.1')) audit(AUDIT_OS_NOT, 'Red Hat 8.1', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/e4s/rhel8/8.1/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.1/x86_64/appstream/os',\n 'content/e4s/rhel8/8.1/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.1/x86_64/baseos/os',\n 'content/e4s/rhel8/8.1/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap/os',\n 'content/e4s/rhel8/8.1/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/appstream/debug',\n 'content/eus/rhel8/8.1/aarch64/appstream/os',\n 'content/eus/rhel8/8.1/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/baseos/debug',\n 'content/eus/rhel8/8.1/aarch64/baseos/os',\n 'content/eus/rhel8/8.1/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.1/aarch64/highavailability/os',\n 'content/eus/rhel8/8.1/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.1/aarch64/supplementary/os',\n 'content/eus/rhel8/8.1/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.1/ppc64le/appstream/os',\n 'content/eus/rhel8/8.1/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.1/ppc64le/baseos/os',\n 'content/eus/rhel8/8.1/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/sap/debug',\n 'content/eus/rhel8/8.1/ppc64le/sap/os',\n 'content/eus/rhel8/8.1/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/appstream/debug',\n 'content/eus/rhel8/8.1/s390x/appstream/os',\n 'content/eus/rhel8/8.1/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/baseos/debug',\n 'content/eus/rhel8/8.1/s390x/baseos/os',\n 'content/eus/rhel8/8.1/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/highavailability/debug',\n 'content/eus/rhel8/8.1/s390x/highavailability/os',\n 'content/eus/rhel8/8.1/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/sap/debug',\n 'content/eus/rhel8/8.1/s390x/sap/os',\n 'content/eus/rhel8/8.1/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/supplementary/debug',\n 'content/eus/rhel8/8.1/s390x/supplementary/os',\n 'content/eus/rhel8/8.1/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/appstream/debug',\n 'content/eus/rhel8/8.1/x86_64/appstream/os',\n 'content/eus/rhel8/8.1/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/baseos/debug',\n 'content/eus/rhel8/8.1/x86_64/baseos/os',\n 'content/eus/rhel8/8.1/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.1/x86_64/highavailability/os',\n 'content/eus/rhel8/8.1/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/sap/debug',\n 'content/eus/rhel8/8.1/x86_64/sap/os',\n 'content/eus/rhel8/8.1/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.1/x86_64/supplementary/os',\n 'content/eus/rhel8/8.1/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.0.0-46.rc4.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:20:06", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2336 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-05-30T00:00:00", "type": "nessus", "title": "RHEL 8 : freerdp (RHSA-2020:2336)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:8.2", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.2", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.2", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel", "cpe:/o:redhat:enterprise_linux:8"], "id": "REDHAT-RHSA-2020-2336.NASL", "href": "https://www.tenable.com/plugins/nessus/136975", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2336. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(136975);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2336\");\n\n script_name(english:\"RHEL 8 : freerdp (RHSA-2020:2336)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2336 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:2336\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836214\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836226\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836234\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(125, 190);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.2/x86_64/appstream/debug',\n 'content/aus/rhel8/8.2/x86_64/appstream/os',\n 'content/aus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.2/x86_64/baseos/debug',\n 'content/aus/rhel8/8.2/x86_64/baseos/os',\n 'content/aus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.2/x86_64/appstream/os',\n 'content/e4s/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.2/x86_64/baseos/os',\n 'content/e4s/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap/os',\n 'content/e4s/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/appstream/debug',\n 'content/eus/rhel8/8.2/aarch64/appstream/os',\n 'content/eus/rhel8/8.2/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/baseos/debug',\n 'content/eus/rhel8/8.2/aarch64/baseos/os',\n 'content/eus/rhel8/8.2/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.2/aarch64/highavailability/os',\n 'content/eus/rhel8/8.2/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.2/aarch64/supplementary/os',\n 'content/eus/rhel8/8.2/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.2/ppc64le/appstream/os',\n 'content/eus/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.2/ppc64le/baseos/os',\n 'content/eus/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap/os',\n 'content/eus/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/appstream/debug',\n 'content/eus/rhel8/8.2/s390x/appstream/os',\n 'content/eus/rhel8/8.2/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/baseos/debug',\n 'content/eus/rhel8/8.2/s390x/baseos/os',\n 'content/eus/rhel8/8.2/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/highavailability/debug',\n 'content/eus/rhel8/8.2/s390x/highavailability/os',\n 'content/eus/rhel8/8.2/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/sap/debug',\n 'content/eus/rhel8/8.2/s390x/sap/os',\n 'content/eus/rhel8/8.2/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/supplementary/debug',\n 'content/eus/rhel8/8.2/s390x/supplementary/os',\n 'content/eus/rhel8/8.2/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/appstream/debug',\n 'content/eus/rhel8/8.2/x86_64/appstream/os',\n 'content/eus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/baseos/debug',\n 'content/eus/rhel8/8.2/x86_64/baseos/os',\n 'content/eus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.2/x86_64/highavailability/os',\n 'content/eus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap/debug',\n 'content/eus/rhel8/8.2/x86_64/sap/os',\n 'content/eus/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.2/x86_64/supplementary/os',\n 'content/eus/rhel8/8.2/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/appstream/debug',\n 'content/tus/rhel8/8.2/x86_64/appstream/os',\n 'content/tus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/baseos/debug',\n 'content/tus/rhel8/8.2/x86_64/baseos/os',\n 'content/tus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.2/x86_64/highavailability/os',\n 'content/tus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/nfv/debug',\n 'content/tus/rhel8/8.2/x86_64/nfv/os',\n 'content/tus/rhel8/8.2/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/rt/debug',\n 'content/tus/rhel8/8.2/x86_64/rt/os',\n 'content/tus/rhel8/8.2/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_2.1', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.0.0-46.rc4.el8_2.1', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_2.1', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_2.1', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_2.1', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/appstream/debug',\n 'content/e4s/rhel8/8.4/aarch64/appstream/os',\n 'content/e4s/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/baseos/debug',\n 'content/e4s/rhel8/8.4/aarch64/baseos/os',\n 'content/e4s/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/appstream/debug',\n 'content/e4s/rhel8/8.4/s390x/appstream/os',\n 'content/e4s/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/baseos/debug',\n 'content/e4s/rhel8/8.4/s390x/baseos/os',\n 'content/e4s/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/nfv/debug',\n 'content/e4s/rhel8/8.4/x86_64/nfv/os',\n 'content/e4s/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_2.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.0.0-46.rc4.el8_2.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_2.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_2.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_2.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_2.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.0.0-46.rc4.el8_2.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_2.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_2.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_2.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_2.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-devel-2.0.0-46.rc4.el8_2.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_2.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_2.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_2.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:03:19", "description": "Security Fix(es) :\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)", "cvss3": {}, "published": "2020-06-02T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200528)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2020-09-28T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:freerdp", "p-cpe:/a:fermilab:scientific_linux:freerdp-debuginfo", "p-cpe:/a:fermilab:scientific_linux:freerdp-devel", "p-cpe:/a:fermilab:scientific_linux:freerdp-libs", "p-cpe:/a:fermilab:scientific_linux:libwinpr", "p-cpe:/a:fermilab:scientific_linux:libwinpr-devel", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20200528_FREERDP_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/137040", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(137040);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/28\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n\n script_name(english:\"Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200528)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Security Fix(es) :\n\n - freerdp: Out-of-bounds write in planar.c\n (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c\n (CVE-2020-11524)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2006&L=SCIENTIFIC-LINUX-ERRATA&P=75\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?cc05ae3b\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-debuginfo-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-devel-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"freerdp-libs-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libwinpr-2.0.0-4.rc4.el7_8\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libwinpr-devel-2.0.0-4.rc4.el7_8\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"freerdp / freerdp-debuginfo / freerdp-devel / freerdp-libs / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-27T14:22:56", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2334 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-08-07T00:00:00", "type": "nessus", "title": "RHEL 7 : freerdp (RHSA-2020:2334)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-devel", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel"], "id": "REDHAT-RHSA-2020-2334.NASL", "href": "https://www.tenable.com/plugins/nessus/139384", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2334. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(139384);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2334\");\n\n script_name(english:\"RHEL 7 : freerdp (RHSA-2020:2334)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2334 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:2334\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836214\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836226\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836234\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(125, 190);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/os',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/os',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/supplementary/debug',\n 'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/debug',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/debug',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/os',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/source/SRPMS',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/os',\n 'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/os',\n 'content/dist/rhel/client/7/7Client/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/client/7/7Client/x86_64/os',\n 'content/dist/rhel/client/7/7Client/x86_64/source/SRPMS',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/debug',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/os',\n 'content/dist/rhel/client/7/7Client/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/source/SRPMS',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/debug',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/os',\n 'content/dist/rhel/computenode/7/7ComputeNode/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/optional/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap-hana/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/source/SRPMS',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/debug',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/os',\n 'content/dist/rhel/power-le/7/7Server/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/os',\n 'content/dist/rhel/power/7/7Server/ppc64/optional/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/os',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/os',\n 'content/dist/rhel/power/7/7Server/ppc64/sap/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/source/SRPMS',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/debug',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/os',\n 'content/dist/rhel/power/7/7Server/ppc64/supplementary/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/os',\n 'content/dist/rhel/server/7/7Server/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/os',\n 'content/dist/rhel/server/7/7Server/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/os',\n 'content/dist/rhel/server/7/7Server/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/server/7/7Server/x86_64/os',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/os',\n 'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/os',\n 'content/dist/rhel/server/7/7Server/x86_64/rt/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/os',\n 'content/dist/rhel/server/7/7Server/x86_64/sap-hana/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/os',\n 'content/dist/rhel/server/7/7Server/x86_64/sap/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/source/SRPMS',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/os',\n 'content/dist/rhel/server/7/7Server/x86_64/supplementary/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/optional/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/sap/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/oracle-java-rm/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/source/SRPMS',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/debug',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/os',\n 'content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/source/SRPMS',\n 'content/fastrack/rhel/client/7/x86_64/debug',\n 'content/fastrack/rhel/client/7/x86_64/optional/debug',\n 'content/fastrack/rhel/client/7/x86_64/optional/os',\n 'content/fastrack/rhel/client/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/client/7/x86_64/os',\n 'content/fastrack/rhel/client/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/computenode/7/x86_64/debug',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/debug',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/os',\n 'content/fastrack/rhel/computenode/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/computenode/7/x86_64/os',\n 'content/fastrack/rhel/computenode/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/power/7/ppc64/debug',\n 'content/fastrack/rhel/power/7/ppc64/optional/debug',\n 'content/fastrack/rhel/power/7/ppc64/optional/os',\n 'content/fastrack/rhel/power/7/ppc64/optional/source/SRPMS',\n 'content/fastrack/rhel/power/7/ppc64/os',\n 'content/fastrack/rhel/power/7/ppc64/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/debug',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/debug',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/os',\n 'content/fastrack/rhel/server/7/x86_64/highavailability/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/optional/debug',\n 'content/fastrack/rhel/server/7/x86_64/optional/os',\n 'content/fastrack/rhel/server/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/os',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/debug',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/os',\n 'content/fastrack/rhel/server/7/x86_64/resilientstorage/source/SRPMS',\n 'content/fastrack/rhel/server/7/x86_64/source/SRPMS',\n 'content/fastrack/rhel/system-z/7/s390x/debug',\n 'content/fastrack/rhel/system-z/7/s390x/optional/debug',\n 'content/fastrack/rhel/system-z/7/s390x/optional/os',\n 'content/fastrack/rhel/system-z/7/s390x/optional/source/SRPMS',\n 'content/fastrack/rhel/system-z/7/s390x/os',\n 'content/fastrack/rhel/system-z/7/s390x/source/SRPMS',\n 'content/fastrack/rhel/workstation/7/x86_64/debug',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/debug',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/os',\n 'content/fastrack/rhel/workstation/7/x86_64/optional/source/SRPMS',\n 'content/fastrack/rhel/workstation/7/x86_64/os',\n 'content/fastrack/rhel/workstation/7/x86_64/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-4.rc4.el7_8', 'cpu':'ppc64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.0.0-4.rc4.el7_8', 'cpu':'ppc64le', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.0.0-4.rc4.el7_8', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-2.0.0-4.rc4.el7_8', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-devel-2.0.0-4.rc4.el7_8', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'freerdp-libs-2.0.0-4.rc4.el7_8', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-2.0.0-4.rc4.el7_8', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libwinpr-devel-2.0.0-4.rc4.el7_8', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:32", "description": "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected by multiple vulnerabilities:\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11524)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-12-09T00:00:00", "type": "nessus", "title": "NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Multiple Vulnerabilities (NS-SA-2020-0076)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2020-12-10T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2020-0076_FREERDP.NASL", "href": "https://www.tenable.com/plugins/nessus/143957", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2020-0076. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(143957);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/12/10\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n\n script_name(english:\"NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Multiple Vulnerabilities (NS-SA-2020-0076)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected\nby multiple vulnerabilities:\n\n - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11521)\n\n - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.\n (CVE-2020-11524)\n\n - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.\n (CVE-2020-11523)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2020-0076\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL freerdp packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/12/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/12/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL CORE 5.04\" &&\n release !~ \"CGSL MAIN 5.04\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nflag = 0;\n\npkgs = {\n 'CGSL CORE 5.04': [\n 'freerdp-2.0.0-4.rc4.el7_8',\n 'freerdp-debuginfo-2.0.0-4.rc4.el7_8',\n 'freerdp-devel-2.0.0-4.rc4.el7_8',\n 'freerdp-libs-2.0.0-4.rc4.el7_8',\n 'libwinpr-2.0.0-4.rc4.el7_8',\n 'libwinpr-devel-2.0.0-4.rc4.el7_8'\n ],\n 'CGSL MAIN 5.04': [\n 'freerdp-2.0.0-4.rc4.el7_8',\n 'freerdp-debuginfo-2.0.0-4.rc4.el7_8',\n 'freerdp-devel-2.0.0-4.rc4.el7_8',\n 'freerdp-libs-2.0.0-4.rc4.el7_8',\n 'libwinpr-2.0.0-4.rc4.el7_8',\n 'libwinpr-devel-2.0.0-4.rc4.el7_8'\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:19:55", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2335 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-05-30T00:00:00", "type": "nessus", "title": "RHEL 8 : freerdp (RHSA-2020:2335)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11521", "CVE-2020-11523", "CVE-2020-11524"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_e4s:8.0", "p-cpe:/a:redhat:enterprise_linux:freerdp", "p-cpe:/a:redhat:enterprise_linux:freerdp-libs", "p-cpe:/a:redhat:enterprise_linux:libwinpr", "p-cpe:/a:redhat:enterprise_linux:libwinpr-devel"], "id": "REDHAT-RHSA-2020-2335.NASL", "href": "https://www.tenable.com/plugins/nessus/136974", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:2335. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(136974);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\"CVE-2020-11521\", \"CVE-2020-11523\", \"CVE-2020-11524\");\n script_xref(name:\"RHSA\", value:\"2020:2335\");\n\n script_name(english:\"RHEL 8 : freerdp (RHSA-2020:2335)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:2335 advisory.\n\n - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)\n\n - freerdp: Integer overflow in region.c (CVE-2020-11523)\n\n - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-11524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:2335\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836214\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836226\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1836234\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(125, 190);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:freerdp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libwinpr-devel\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.0')) audit(AUDIT_OS_NOT, 'Red Hat 8.0', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/e4s/rhel8/8.0/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.0/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.0/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.0/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.0/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.0/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.0/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.0/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.0/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.0/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.0/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.0/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.0/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.0/ppc64le/sap/os',\n 'content/e4s/rhel8/8.0/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.0/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.0/x86_64/appstream/os',\n 'content/e4s/rhel8/8.0/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.0/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.0/x86_64/baseos/os',\n 'content/e4s/rhel8/8.0/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.0/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.0/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.0/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.0/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.0/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.0/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.0/x86_64/sap/debug',\n 'content/e4s/rhel8/8.0/x86_64/sap/os',\n 'content/e4s/rhel8/8.0/x86_64/sap/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'freerdp-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'freerdp-libs-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'i686', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'libwinpr-devel-2.0.0-46.rc4.el8_0.1', 'sp':'0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Update Services for SAP Solutions repository.\\n' +\n 'Access to this repository requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-libs / libwinpr / libwinpr-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T14:09:08", "description": "Several vulnerabilites have been reported against FreeRDP, an Open Source server and client implementation of the Microsoft RDP protocol.\n\nCVE-2014-0791\n\nAn integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP allowed remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.\n\nCVE-2020-11042\n\nIn FreeRDP there was an out-of-bounds read in update_read_icon_info.\nIt allowed reading an attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This could have been used to crash the client or store information for later retrieval.\n\nCVE-2020-11045\n\nIn FreeRDP there was an out-of-bound read in in update_read_bitmap_data that allowed client memory to be read to an image buffer. The result displayed on screen as colour.\n\nCVE-2020-11046\n\nIn FreeRDP there was a stream out-of-bounds seek in update_read_synchronize that could have lead to a later out-of-bounds read.\n\nCVE-2020-11048\n\nIn FreeRDP there was an out-of-bounds read. It only allowed to abort a session. No data extraction was possible.\n\nCVE-2020-11058\n\nIn FreeRDP, a stream out-of-bounds seek in rdp_read_font_capability_set could have lead to a later out-of-bounds read. As a result, a manipulated client or server might have forced a disconnect due to an invalid data read.\n\nCVE-2020-11521\n\nlibfreerdp/codec/planar.c in FreeRDP had an Out-of-bounds Write.\n\nCVE-2020-11522\n\nlibfreerdp/gdi/gdi.c in FreeRDP had an Out-of-bounds Read.\n\nCVE-2020-11523\n\nlibfreerdp/gdi/region.c in FreeRDP had an Integer Overflow.\n\nCVE-2020-11525\n\nlibfreerdp/cache/bitmap.c in FreeRDP had an Out of bounds read.\n\nCVE-2020-11526\n\nlibfreerdp/core/update.c in FreeRDP had an Out-of-bounds Read.\n\nCVE-2020-13396\n\nAn out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n\nCVE-2020-13397\n\nAn out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.\n\nCVE-2020-13398\n\nAn out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.\n\nFor Debian 9 stretch, these problems have been fixed in version 1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4.\n\nWe recommend that you upgrade your freerdp packages.\n\nFor the detailed security status of freerdp please refer to its security tracker page at:\nhttps://security-tracker.debian.org/tracker/freerdp\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-08-31T00:00:00", "type": "nessus", "title": "Debian DLA-2356-1 : freerdp security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0791", "CVE-2020-11042", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11048", "CVE-2020-11058", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398"], "modified": "2020-09-24T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libxfreerdp-client1.1", "cpe:/o:debian:debian_linux:9.0", "p-cpe:/a:debian:debian_linux:freerdp-x11", "p-cpe:/a:debian:debian_linux:freerdp-x11-dbg", "p-cpe:/a:debian:debian_linux:libfreerdp-cache1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-client1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-codec1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-common1.1.0", "p-cpe:/a:debian:debian_linux:libfreerdp-core1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-crypto1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-dbg", "p-cpe:/a:debian:debian_linux:libfreerdp-dev", "p-cpe:/a:debian:debian_linux:libfreerdp-gdi1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-locale1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-plugins-standard", "p-cpe:/a:debian:debian_linux:libfreerdp-plugins-standard-dbg", "p-cpe:/a:debian:debian_linux:libfreerdp-primitives1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-rail1.1", "p-cpe:/a:debian:debian_linux:libfreerdp-utils1.1", "p-cpe:/a:debian:debian_linux:libwinpr-asn1-0.1", "p-cpe:/a:debian:debian_linux:libwinpr-bcrypt0.1", "p-cpe:/a:debian:debian_linux:libwinpr-credentials0.1", "p-cpe:/a:debian:debian_linux:libwinpr-credui0.1", "p-cpe:/a:debian:debian_linux:libwinpr-crt0.1", "p-cpe:/a:debian:debian_linux:libwinpr-crypto0.1", "p-cpe:/a:debian:debian_linux:libwinpr-dbg", "p-cpe:/a:debian:debian_linux:libwinpr-dev", "p-cpe:/a:debian:debian_linux:libwinpr-dsparse0.1", "p-cpe:/a:debian:debian_linux:libwinpr-environment0.1", "p-cpe:/a:debian:debian_linux:libwinpr-error0.1", "p-cpe:/a:debian:debian_linux:libwinpr-file0.1", "p-cpe:/a:debian:debian_linux:libwinpr-handle0.1", "p-cpe:/a:debian:debian_linux:libwinpr-heap0.1", "p-cpe:/a:debian:debian_linux:libwinpr-input0.1", "p-cpe:/a:debian:debian_linux:libwinpr-interlocked0.1", "p-cpe:/a:debian:debian_linux:libwinpr-io0.1", "p-cpe:/a:debian:debian_linux:libwinpr-library0.1", "p-cpe:/a:debian:debian_linux:libwinpr-path0.1", "p-cpe:/a:debian:debian_linux:libwinpr-pipe0.1", "p-cpe:/a:debian:debian_linux:libwinpr-pool0.1", "p-cpe:/a:debian:debian_linux:libwinpr-registry0.1", "p-cpe:/a:debian:debian_linux:libwinpr-rpc0.1", "p-cpe:/a:debian:debian_linux:libwinpr-sspi0.1", "p-cpe:/a:debian:debian_linux:libwinpr-sspicli0.1", "p-cpe:/a:debian:debian_linux:libwinpr-synch0.1", "p-cpe:/a:debian:debian_linux:libwinpr-sysinfo0.1", "p-cpe:/a:debian:debian_linux:libwinpr-thread0.1", "p-cpe:/a:debian:debian_linux:libwinpr-timezone0.1", "p-cpe:/a:debian:debian_linux:libwinpr-utils0.1", "p-cpe:/a:debian:debian_linux:libwinpr-winhttp0.1", "p-cpe:/a:debian:debian_linux:libwinpr-winsock0.1", "p-cpe:/a:debian:debian_linux:libxfreerdp-client-dbg"], "id": "DEBIAN_DLA-2356.NASL", "href": "https://www.tenable.com/plugins/nessus/140055", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-2356-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(140055);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/24\");\n\n script_cve_id(\"CVE-2014-0791\", \"CVE-2020-11042\", \"CVE-2020-11045\", \"CVE-2020-11046\", \"CVE-2020-11048\", \"CVE-2020-11058\", \"CVE-2020-11521\", \"CVE-2020-11522\", \"CVE-2020-11523\", \"CVE-2020-11525\", \"CVE-2020-11526\", \"CVE-2020-13396\", \"CVE-2020-13397\", \"CVE-2020-13398\");\n script_bugtraq_id(64689);\n\n script_name(english:\"Debian DLA-2356-1 : freerdp security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Several vulnerabilites have been reported against FreeRDP, an Open\nSource server and client implementation of the Microsoft RDP protocol.\n\nCVE-2014-0791\n\nAn integer overflow in the license_read_scope_list function in\nlibfreerdp/core/license.c in FreeRDP allowed remote RDP servers to\ncause a denial of service (application crash) or possibly have\nunspecified other impact via a large ScopeCount value in a Scope List\nin a Server License Request packet.\n\nCVE-2020-11042\n\nIn FreeRDP there was an out-of-bounds read in update_read_icon_info.\nIt allowed reading an attacker-defined amount of client memory (32bit\nunsigned -> 4GB) to an intermediate buffer. This could have been used\nto crash the client or store information for later retrieval.\n\nCVE-2020-11045\n\nIn FreeRDP there was an out-of-bound read in in\nupdate_read_bitmap_data that allowed client memory to be read to an\nimage buffer. The result displayed on screen as colour.\n\nCVE-2020-11046\n\nIn FreeRDP there was a stream out-of-bounds seek in\nupdate_read_synchronize that could have lead to a later out-of-bounds\nread.\n\nCVE-2020-11048\n\nIn FreeRDP there was an out-of-bounds read. It only allowed to abort a\nsession. No data extraction was possible.\n\nCVE-2020-11058\n\nIn FreeRDP, a stream out-of-bounds seek in\nrdp_read_font_capability_set could have lead to a later out-of-bounds\nread. As a result, a manipulated client or server might have forced a\ndisconnect due to an invalid data read.\n\nCVE-2020-11521\n\nlibfreerdp/codec/planar.c in FreeRDP had an Out-of-bounds Write.\n\nCVE-2020-11522\n\nlibfreerdp/gdi/gdi.c in FreeRDP had an Out-of-bounds Read.\n\nCVE-2020-11523\n\nlibfreerdp/gdi/region.c in FreeRDP had an Integer Overflow.\n\nCVE-2020-11525\n\nlibfreerdp/cache/bitmap.c in FreeRDP had an Out of bounds read.\n\nCVE-2020-11526\n\nlibfreerdp/core/update.c in FreeRDP had an Out-of-bounds Read.\n\nCVE-2020-13396\n\nAn out-of-bounds (OOB) read vulnerability has been detected in\nntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.\n\nCVE-2020-13397\n\nAn out-of-bounds (OOB) read vulnerability has been detected in\nsecurity_fips_decrypt in libfreerdp/core/security.c due to an\nuninitialized value.\n\nCVE-2020-13398\n\nAn out-of-bounds (OOB) write vulnerability has been detected in\ncrypto_rsa_common in libfreerdp/crypto/crypto.c.\n\nFor Debian 9 stretch, these problems have been fixed in version\n1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4.\n\nWe recommend that you upgrade your freerdp packages.\n\nFor the detailed security status of freerdp please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/freerdp\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/freerdp\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/freerdp\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2014-0791\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:freerdp-x11-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-cache1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-client1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-codec1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-common1.1.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-core1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-crypto1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-gdi1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-locale1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-plugins-standard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-plugins-standard-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-primitives1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-rail1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfreerdp-utils1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-asn1-0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-bcrypt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-credentials0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-credui0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-crt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-crypto0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-dsparse0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-environment0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-error0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-file0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-handle0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-heap0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-input0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-interlocked0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-io0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-library0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-path0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-pipe0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-pool0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-registry0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-rpc0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-sspi0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-sspicli0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-synch0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-sysinfo0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-thread0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-timezone0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-utils0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-winhttp0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libwinpr-winsock0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxfreerdp-client-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxfreerdp-client1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/31\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"freerdp-x11\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"freerdp-x11-dbg\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-cache1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-client1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-codec1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-common1.1.0\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-core1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-crypto1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-dbg\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-dev\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-gdi1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-locale1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-plugins-standard\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-plugins-standard-dbg\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-primitives1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-rail1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfreerdp-utils1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-asn1-0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-bcrypt0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-credentials0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-credui0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-crt0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-crypto0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-dbg\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-dev\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-dsparse0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-environment0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-error0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-file0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-handle0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-heap0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-input0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-interlocked0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-io0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-library0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-path0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-pipe0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-pool0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-registry0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-rpc0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-sspi0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-sspicli0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-synch0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-sysinfo0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-thread0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-timezone0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-utils0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-winhttp0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libwinpr-winsock0.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libxfreerdp-client-dbg\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libxfreerdp-client1.1\", reference:\"1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-21T15:28:01", "description": "It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-06-05T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : FreeRDP vulnerabilities (USN-4382-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11042", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-codec1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-common1.1.0", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-core1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-crypto1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-dev", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-gdi1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-locale1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-plugins-standard", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-primitives1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-rail1.1", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-utils1.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-asn1-0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-bcrypt0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-credentials0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-credui0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-crt0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-crypto0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-dev", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-dsparse0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-environment0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-error0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-file0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-handle0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-heap0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-input0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-interlocked0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-io0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-library0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-path0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-pipe0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-pool0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-registry0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-rpc0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspi0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspicli0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-synch0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-sysinfo0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-thread0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-timezone0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-utils0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-winhttp0.1", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-winsock0.1", "p-cpe:/a:canonical:ubuntu_linux:libxfreerdp-client1.1", "cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:freerdp-x11", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-cache1.1"], "id": "UBUNTU_USN-4382-1.NASL", "href": "https://www.tenable.com/plugins/nessus/137178", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4382-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137178);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\n \"CVE-2020-11042\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11521\",\n \"CVE-2020-11522\",\n \"CVE-2020-11523\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\"\n );\n script_xref(name:\"USN\", value:\"4382-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : FreeRDP vulnerabilities (USN-4382-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"It was discovered that FreeRDP incorrectly handled certain memory\noperations. A remote attacker could use this issue to cause FreeRDP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4382-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-codec1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-common1.1.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-core1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-crypto1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-gdi1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-locale1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-plugins-standard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-primitives1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-rail1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-utils1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-asn1-0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-bcrypt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-credentials0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-credui0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-crt0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-crypto0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-dsparse0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-environment0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-error0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-file0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-handle0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-heap0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-input0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-interlocked0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-io0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-library0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-path0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-pipe0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-pool0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-registry0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-rpc0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspi0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sspicli0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-synch0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-sysinfo0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-thread0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-timezone0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-utils0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-winhttp0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwinpr-winsock0.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxfreerdp-client1.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:freerdp-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libfreerdp-cache1.1\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('16.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '16.04', 'pkgname': 'freerdp-x11', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-cache1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-client1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-codec1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-common1.1.0', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-core1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-crypto1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-dev', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-gdi1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-locale1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-plugins-standard', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-primitives1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-rail1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libfreerdp-utils1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-asn1-0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-bcrypt0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-credentials0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-credui0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-crt0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-crypto0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-dev', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-dsparse0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-environment0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-error0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-file0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-handle0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-heap0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-input0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-interlocked0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-io0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-library0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-path0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-pipe0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-pool0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-registry0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-rpc0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-sspi0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-sspicli0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-synch0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-sysinfo0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-thread0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-timezone0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-utils0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-winhttp0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libwinpr-winsock0.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'},\n {'osver': '16.04', 'pkgname': 'libxfreerdp-client1.1', 'pkgver': '1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp-x11 / libfreerdp-cache1.1 / libfreerdp-client1.1 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-21T15:29:24", "description": "It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly exeucte arbitrary code.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-06-02T00:00:00", "type": "nessus", "title": "Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4379-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-1000852", "CVE-2019-17177", "CVE-2020-11042", "CVE-2020-11044", "CVE-2020-11045", "CVE-2020-11046", "CVE-2020-11047", "CVE-2020-11048", "CVE-2020-11049", "CVE-2020-11058", "CVE-2020-11521", "CVE-2020-11522", "CVE-2020-11523", "CVE-2020-11524", "CVE-2020-11525", "CVE-2020-11526", "CVE-2020-13396", "CVE-2020-13397", "CVE-2020-13398"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libfreerdp-client2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-server2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow-subsystem2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp-shadow2-2", "p-cpe:/a:canonical:ubuntu_linux:libfreerdp2-2", "p-cpe:/a:canonical:ubuntu_linux:libuwac0-0", "p-cpe:/a:canonical:ubuntu_linux:libuwac0-dev", "p-cpe:/a:canonical:ubuntu_linux:libwinpr-tools2-2", "p-cpe:/a:canonical:ubuntu_linux:libwinpr2-2", "p-cpe:/a:canonical:ubuntu_linux:libwinpr2-dev", "p-cpe:/a:canonical:ubuntu_linux:winpr-utils", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-dev", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-shadow-x11", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-wayland", "p-cpe:/a:canonical:ubuntu_linux:freerdp2-x11"], "id": "UBUNTU_USN-4379-1.NASL", "href": "https://www.tenable.com/plugins/nessus/137045", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4379-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137045);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\n \"CVE-2018-1000852\",\n \"CVE-2019-17177\",\n \"CVE-2020-11042\",\n \"CVE-2020-11044\",\n \"CVE-2020-11045\",\n \"CVE-2020-11046\",\n \"CVE-2020-11047\",\n \"CVE-2020-11048\",\n \"CVE-2020-11049\",\n \"CVE-2020-11058\",\n \"CVE-2020-11521\",\n \"CVE-2020-11522\",\n \"CVE-2020-11523\",\n \"CVE-2020-11524\",\n \"CVE-2020-11525\",\n \"CVE-2020-11526\",\n \"CVE-2020-13396\",\n \"CVE-2020-13397\",\n \"CVE-2020-13398\"\n );\n script_xref(name:\"USN\", value:\"4379-1\");\n\n script_name(english:\"Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4379-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"It was discovered that FreeRDP incorrectly handled certain memory\noperations. A remote attacker could use this issue to cause FreeRDP to\ncrash, resulting in a denial of service, or possibly exeucte arbitrary\ncode.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4379-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13398\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/12/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribu