CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791557610)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(368055);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-66402",
    "CVE-2026-67289",
    "CVE-2026-67300",
    "CVE-2026-68580"
  );
  script_xref(name:"CLSA", value:"2026:1791557610");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791557610)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1791557610 advisory.

  - FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation
    weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because
    FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware
    identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g.
    'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when
    non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without
    comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to
    present such a certificate can bypass server identity verification, weakening TLS server authentication.
    (CVE-2026-66402)

  - FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the
    server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's
    ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy
    CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised
    RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary
    headers/requests into the HTTP proxy CONNECT request. (CVE-2026-67289)

  - FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message
    proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a
    malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies
    structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects,
    icon buffers). The parser frees those nested buffers after the callback returns, so the queued async
    message later dispatches stale pointers, potentially causing memory corruption or a client crash.
    (CVE-2026-67300)

  - FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel
    (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket
    parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size
    wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
    (CVE-2026-68580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1791557610.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f6c621e");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1791557610");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1791557610.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67289");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els4', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');
}