TencentOS Server 2: freerdp (TSSA-2026:1359)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1359.
##

include('compat.inc');

if (description)
{
  script_id(375727);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/04");

  script_cve_id(
    "CVE-2026-55192",
    "CVE-2026-55194",
    "CVE-2026-67288",
    "CVE-2026-67290",
    "CVE-2026-67291",
    "CVE-2026-67298",
    "CVE-2026-67301"
  );
  script_xref(name:"IAVA", value:"2026-A-0867-S");

  script_name(english:"TencentOS Server 2: freerdp (TSSA-2026:1359)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 2 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1359 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-55192:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder
    backends can return YUV planes sized from the bitstream without comparing the decoded width and height to
    the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an
    AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing
    yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in
    libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the
    client. This issue is fixed in version 3.27.0.

    CVE-2026-55194:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment
    in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the
    server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway
    can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to
    copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may
    permit code execution through heap corruption. This issue is fixed in version 3.27.0.

    CVE-2026-67288:
    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request
    decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and
    SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted
    smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing
    client process termination.

    CVE-2026-67290:
    FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when
    parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media
    format data from a server to trigger a crash by reading fixed offsets without validating source buffer
    length.

    CVE-2026-67291:
    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in
    update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a
    GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not
    verify it fits within the remaining received buffer before allocating and copying that many bytes. A
    malicious RDP server can send a short fragment with an oversized declared size, causing the client to read
    beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

    CVE-2026-67298:
    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler
    (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header,
    the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first
    verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned
    integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check
    (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-
    of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash
    the server. Fixed in FreeRDP 3.29.0.

    CVE-2026-67301:
    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for
    the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-
    update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy
    point data from the address of the order structure instead of from polygonSC->points / polygonCB->points,
    resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted
    PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261359.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55194");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-67301");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:freerdp");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 2.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '2',
    'pkgs': [
      {'reference':'freerdp-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-debuginfo-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.tl2.12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-debuginfo / freerdp-devel / etc');
}