TencentOS Server 2: freerdp (TSSA-2026:0751)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0751.
##

include('compat.inc');

if (description)
{
  script_id(329208);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id(
    "CVE-2026-25952",
    "CVE-2026-26986",
    "CVE-2026-27951",
    "CVE-2026-29775",
    "CVE-2026-31883",
    "CVE-2026-31884",
    "CVE-2026-31885",
    "CVE-2026-33985"
  );
  script_xref(name:"IAVA", value:"2026-A-0257-S");
  script_xref(name:"IAVA", value:"2026-A-0286-S");

  script_name(english:"TencentOS Server 2: freerdp (TSSA-2026:0751)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 2 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0751 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-25952:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0,
    xf_SetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xf_rail_get_window in
    xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table, and the main
    thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is
    still using the pointer. Version 3.23.0 fixes the issue.

    CVE-2026-26986:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, rail_window_free
    dereferences a freed xfAppWindow pointer during HashTable_Free cleanup because xf_rail_window_common calls
    free(appWindow) on title allocation failure without first removing the entry from the railWindows hash
    table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the
    vulnerability.

    CVE-2026-27951:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function
    Stream_EnsureCapacity can create an endless blocking loop. This may affect all client and server
    implementations using FreeRDP. For practical exploitation this will only work on 32bit systems where the
    available physical memory is >= SIZE_MAX. Version 3.23.0 contains a patch. No known workarounds are
    available.

    CVE-2026-29775:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-
    of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in
    bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,
    bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is
    fixed in 3.24.0.

    CVE-2026-31883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in
    the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio
    channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a
    size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such
    that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header
    (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an
    astronomical number of iterations. This vulnerability is fixed in 3.24.0.

    CVE-2026-31884:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-
    ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both
    ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The
    nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not
    validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE
    (floating point exception) crash. This vulnerability is fixed in 3.24.0.

    CVE-2026-31885:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-
    bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input
    data. This vulnerability is fixed in 3.24.0.

    CVE-2026-33985:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from
    adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue
    has been patched in version 3.24.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260751.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31883");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-26986");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:freerdp");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 2.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '2',
    'pkgs': [
      {'reference':'freerdp-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-debuginfo-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.tl2.9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-debuginfo / freerdp-devel / etc');
}