远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 2336 公告中提及的多个漏洞的影响。

  - freerdp：planar.c 中存在越界写入 (CVE-2020-11521)

  - freerdp：region.c 中存在整数溢出 (CVE-2020-11523)

  - freerdp：interleaved.c 中存在越界写入 (CVE-2020-11524)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

安全修复：

  - freerdp：planar.c 中存在越界写入 (CVE-2020-11521)

  - freerdp：region.c 中存在整数溢出 (CVE-2020-11523)

  - freerdp：interleaved.c 中存在越界写入 (CVE-2020-11524)

来自 Red Hat 安全公告 2020:2334：

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 2334 公告中提及的多个漏洞的影响。

  - freerdp：planar.c 中存在越界写入 (CVE-2020-11521)

  - freerdp：region.c 中存在整数溢出 (CVE-2020-11523)

  - freerdp：interleaved.c 中存在越界写入 (CVE-2020-11524)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

运行 CORE 5.04/MAIN 5.04 版本的远程 NewStart CGSL 主机上安装的 freerdp 程序包受到多个漏洞的影响：

  - FreeRDP > 1.0 至 2.0.0-rc4 版本的 libfreerdp/codec/planar.c 中存在越界写入。
    (CVE-2020-11521)

  - 在 > 1.0 版本至 2.0.0-rc4 版本的 FreeRDP 中，libfreerdp/codec/interleaved.c 存在越界写入。
    (CVE-2020-11524)

  - FreeRDP > 1.0 至 2.0.0-rc4 版本的 libfreerdp/gdi/region.c 中存在整数溢出。
    (CVE-2020-11523)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 2334 公告中提及的多个漏洞的影响。

  - freerdp：planar.c 中存在越界写入 (CVE-2020-11521)

  - freerdp：region.c 中存在整数溢出 (CVE-2020-11523)

  - freerdp：interleaved.c 中存在越界写入 (CVE-2020-11524)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In FreeRDP after 1.0 and before 2.0.0, there is an     out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The     result displayed on screen as colour.(CVE-2020-11045)

  - In FreeRDP before version 2.1.2, there is a global OOB     read in update_read_cache_bitmap_v3_order. As a     workaround, one can disable bitmap cache with
    -bitmap-cache (default). This is fixed in version     2.1.2.(CVE-2020-11096)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0     through 2.0.0-rc4 has an Integer     Overflow.(CVE-2020-11523)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In FreeRDP after 1.0 and before 2.0.0, there is an     out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The     result displayed on screen as colour.(CVE-2020-11045)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0     through 2.0.0-rc4 has an Integer     Overflow.(CVE-2020-11523)

  - In FreeRDP before version 2.1.2, there is a global OOB     read in update_read_cache_bitmap_v3_order. As a     workaround, one can disable bitmap cache with
    -bitmap-cache (default). This is fixed in version     2.1.2.(CVE-2020-11096)

  - An exploitable code execution vulnerability exists in     the authentication functionality of FreeRDP     2.0.0-beta1+android11. A specially crafted server     response can cause an out-of-bounds write resulting in     an exploitable condition. An attacker can compromise     the server or use a man in the middle attack to trigger     this vulnerability.(CVE-2017-2834)

  - An exploitable code execution vulnerability exists in     the RDP receive functionality of FreeRDP     2.0.0-beta1+android11. A specially crafted server     response can cause an out-of-bounds write resulting in     an exploitable condition. An attacker can compromise     the server or use a man in the middle to trigger this     vulnerability.(CVE-2017-2835)

  - An exploitable denial of service vulnerability exists     within the reading of proprietary server certificates     in FreeRDP 2.0.0-beta1+android11. A specially crafted     challenge packet can cause the program termination     leading to a denial of service condition. An attacker     can compromise the server or use man in the middle to     trigger this vulnerability.(CVE-2017-2836)

  - An exploitable denial of service vulnerability exists     within the handling of security data in FreeRDP     2.0.0-beta1+android11. A specially crafted challenge     packet can cause the program termination leading to a     denial of service condition. An attacker can compromise     the server or use man in the middle to trigger this     vulnerability.(CVE-2017-2837)

  - An exploitable denial of service vulnerability exists     within the handling of challenge packets in FreeRDP     2.0.0-beta1+android11. A specially crafted challenge     packet can cause the program termination leading to a     denial of service condition. An attacker can compromise     the server or use man in the middle to trigger this     vulnerability.(CVE-2017-2838)

  - An exploitable denial of service vulnerability exists     within the handling of challenge packets in FreeRDP     2.0.0-beta1+android11. A specially crafted challenge     packet can cause the program termination leading to a     denial of service condition. An attacker can compromise     the server or use man in the middle to trigger this     vulnerability.(CVE-2017-2839)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4382-2 advisory.

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use     this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilites have been reported against FreeRDP, an Open Source server and client implementation of the Microsoft RDP protocol.

CVE-2014-0791

An integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP allowed remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.

CVE-2020-11042

In FreeRDP there was an out-of-bounds read in update_read_icon_info.
It allowed reading an attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This could have been used to crash the client or store information for later retrieval.

CVE-2020-11045

In FreeRDP there was an out-of-bound read in in update_read_bitmap_data that allowed client memory to be read to an image buffer. The result displayed on screen as colour.

CVE-2020-11046

In FreeRDP there was a stream out-of-bounds seek in update_read_synchronize that could have lead to a later out-of-bounds read.

CVE-2020-11048

In FreeRDP there was an out-of-bounds read. It only allowed to abort a session. No data extraction was possible.

CVE-2020-11058

In FreeRDP, a stream out-of-bounds seek in rdp_read_font_capability_set could have lead to a later out-of-bounds read. As a result, a manipulated client or server might have forced a disconnect due to an invalid data read.

CVE-2020-11521

libfreerdp/codec/planar.c in FreeRDP had an Out-of-bounds Write.

CVE-2020-11522

libfreerdp/gdi/gdi.c in FreeRDP had an Out-of-bounds Read.

CVE-2020-11523

libfreerdp/gdi/region.c in FreeRDP had an Integer Overflow.

CVE-2020-11525

libfreerdp/cache/bitmap.c in FreeRDP had an Out of bounds read.

CVE-2020-11526

libfreerdp/core/update.c in FreeRDP had an Out-of-bounds Read.

CVE-2020-13396

An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.

CVE-2020-13397

An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.

CVE-2020-13398

An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.

For Debian 9 stretch, these problems have been fixed in version 1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4.

We recommend that you upgrade your freerdp packages.

For the detailed security status of freerdp please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/freerdp

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2354 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

    * freerdp: Integer overflow in region.c (CVE-2020-11523)

    * freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202005-07 (FreeRDP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeRDP. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

據報告，FreeRDP (一種 Microsoft RDP 通訊協定的開放原始碼伺服器和用戶端實作) 中有數個弱點。

CVE-2014-0791

在 FreeRDP 中，libfreerdp/core/license.c 的 license_read_scope_list 函式中存在整數溢位弱點，允許遠端 RDP 伺服器透過伺服器授權要求封包之範圍清單中的大型 ScopeCount 值造成拒絕服務 (應用程式損毀)，或可能造成其他不明影響。

CVE-2020-11042

- 在 FreeRDP 中，update_read_icon_info 中存在超出邊界讀取問題。
允許將攻擊者定義的用戶端記憶體量 (32 位元無正負號 -> 4GB) 讀取至中繼緩衝區。這可用來損毀用戶端，或儲存資訊以供日後擷取。

CVE-2020-11045

- 在 FreeRDP 中，update_read_bitmap_data 中存在超出邊界讀取問題，攻擊者可以將用戶端記憶體資料讀取至圖像緩衝區。結果在螢幕上顯示為色彩。

CVE-2020-11046

- 在 FreeRDP 中，update_read_synchronize 中存在資料流超出邊界搜尋問題，可導致之後發生超出邊界讀取。

CVE-2020-11048

- FreeRDP 中存在超出邊界讀取問題。僅允許中止工作階段。無法擷取任何資料。

CVE-2020-11058

- 在 FreeRDP 中，rdp_read_font_capability_set 中存在資料流超出邊界搜尋問題，可導致之後發生超出邊界讀取。因此，受操控的用戶端或伺服器可能會因為無效的資料讀取而強制中斷連線。

CVE-2020-11521

在 FreeRDP 的 libfreerdp/codec/planar.c 中有一個超出邊界寫入問題。

CVE-2020-11522

在 FreeRDP 的 libfreerdp/gdi/gdi.c 中有一個超出邊界讀取問題。

CVE-2020-11523

在 FreeRDP 的 libfreerdp/gdi/region.c 中有一個整數溢位問題。

CVE-2020-11525

在 FreeRDP 的 libfreerdp/cache/bitmap.c 中有一個超出邊界讀取問題。

CVE-2020-11526

在 FreeRDP 的 libfreerdp/core/update.c 中有一個超出邊界讀取問題。

CVE-2020-13396

在 winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中發現一個超出邊界 (OOB) 讀取弱點。

CVE-2020-13397

在 libfreerdp/core/security.c 的 security_fips_decrypt 中偵測到一個超出邊界 (OOB) 讀取弱點，這是因為一個未初始化的值所致。

CVE-2020-13398

在 libfreerdp/crypto/crypto.c 的 crypto_rsa_common 中偵測到一個超出邊界 (OOB) 寫入弱點。

針對 Debian 9「Stretch」，已在 1.1.0~git20140921.1.440916e+dfsg1-13+deb9u4 版本中修正這些問題。

建議您升級 freerdp 套件。

如需有關 freerdp 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：
https://security-tracker.debian.org/tracker/freerdp

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 2354 公告中提及的多個弱點影響。

  - freerdp：planar.c 中存在超出邊界寫入 (CVE-2020-11521)

  - freerdp：region.c 中存在整數溢位 (CVE-2020-11523)

  - freerdp：interleaved.c 中存在超出邊界寫入 (CVE-2020-11524)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機受到 GLSA-202005-07 中所述的弱點影響 (FreeRDP：多個弱點)

    在 FreeRDP 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    攻擊者可能會造成拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

遠端 Ubuntu 18.04 LTS 主機上安裝的套件受到 USN-4382-2 公告中所提及的多個弱點影響。

  - 在晚於 1.1 且早於 2.0.0 的 FreeRDP 版本中，update_read_icon_info 中存在超出邊界讀取問題。允許讀取攻擊者定義的用戶端記憶體量 (32 位元無正負號 -> 4GB) 至中繼緩衝區。這可用來損毀用戶端，或儲存資訊以供日後擷取。2.0.0 版對此問題作了修補。(CVE-2020-11042)

  - 在晚於 1.0 且早於 2.0.0 的 FreeRDP 版本中，update_read_bitmap_data 中存在超出邊界讀取問題，攻擊者可以將用戶端記憶體資料讀取至圖像緩衝區。結果在螢幕上顯示為色彩。
    (CVE-2020-11045)

  - 在晚於 1.0 且早於 2.0.0 的 FreeRDP 版本中，update_read_synchronize 中存在資料流超出邊界搜尋，可導致之後發生超出邊界讀取。(CVE-2020-11046)

  - 在晚於 1.0 且早於 2.0.0 的 FreeRDP 版本中，存在超出邊界讀取問題。它僅允許中止工作階段。
    無法擷取任何資料。2.0.0 版中已修正此問題。(CVE-2020-11048)

  - 在晚於 1.1 且早於 2.0.0 的 FreeRDP 版本中，rdp_read_font_capability_set 中存在資料流超出邊界搜尋，可導致之後發生超出邊界讀取。因此，受操控的用戶端或伺服器可能會因為無效的資料讀取而強制中斷連線。2.0.0 版中已修正此問題。(CVE-2020-11058)

  - 在 FreeRDP 1.0 (不含) 至 2.0.0-rc4 的版本中，libfreerdp/codec/planar.c 中存在超出邊界讀取問題。
    (CVE-2020-11521)

  - 在 FreeRDP 1.0 (不含) 至 2.0.0-rc4 的版本中，libfreerdp/gdi/gdi.c 中存在超出邊界讀取問題。(CVE-2020-11522)

  在 FreeRDP 1.0 (不含) 至 2.0.0-rc4 的版本中，libfreerdp/gdi/region.c 中存在整數溢位問題。
    (CVE-2020-11523)

  - 在 FreeRDP 1.0 (不含) 至 2.0.0-rc4 的版本中，libfreerdp/cache/bitmap.c 中存在超出邊界讀取問題。
    (CVE-2020-11525)

  - 在 FreeRDP 1.1 (不含) 至 2.0.0-rc4 版本中，libfreerdp/core/update.c 中存在超出邊界讀取問題。
    (CVE-2020-11526)

  - 在 FreeRDP 2.1.1 之前版本中發現一個問題。在 winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中發現超出邊界 (OOB) 讀取弱點。(CVE-2020-13396)

  - 在 FreeRDP 2.1.1 之前版本中發現一個問題。在 libfreerdp/core/security.c 的 security_fips_decrypt 中偵測到超出邊界 (OOB) 讀取弱點，這是未初始化值所致。
    (CVE-2020-13397)

  - 在 FreeRDP 2.1.1 之前版本中發現一個問題。在 libfreerdp/crypto/crypto.c 的 crypto_rsa_common 中偵測到超出邊界 (OOB) 寫入弱點 (CVE-2020-13398)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136975	RHEL 8：freerdp (RHSA-2020: 2336)	Nessus	Red Hat Local Security Checks	2020/5/30	2024/11/7	medium
137040	Scientific Linux 安全更新：SL7.x x86_64 中的 freerdp (20200528)	Nessus	Scientific Linux Local Security Checks	2020/6/2	2024/3/8	medium
137171	Oracle Linux 7：freerdp (ELSA-2020-2334)	Nessus	Oracle Linux Local Security Checks	2020/6/5	2024/10/22	medium
143957	NewStart CGSL CORE 5.04 / MAIN 5.04：freerdp 多个漏洞 (NS-SA-2020-0076)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	medium
139384	RHEL 7：freerdp (RHSA-2020: 2334)	Nessus	Red Hat Local Security Checks	2020/8/7	2024/11/7	medium
145103	EulerOS 2.0 SP3 : freerdp (EulerOS-SA-2021-1066)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/30	medium
146158	EulerOS 2.0 SP5 : freerdp (EulerOS-SA-2021-1188)	Nessus	Huawei Local Security Checks	2021/2/4	2024/1/23	high
143270	Ubuntu 18.04 LTS : FreeRDP vulnerabilities (USN-4382-2)	Nessus	Ubuntu Local Security Checks	2020/11/26	2024/8/29	high
140055	Debian DLA-2356-1 : freerdp security update	Nessus	Debian Local Security Checks	2020/8/31	2024/2/22	high
137059	RHEL 8 : freerdp (RHSA-2020:2354)	Nessus	Red Hat Local Security Checks	2020/6/3	2024/11/7	medium
136637	GLSA-202005-07 : FreeRDP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/5/15	2024/3/12	medium
140055	Debian DLA-2356-1：freerdp 安全性更新	Nessus	Debian Local Security Checks	2020/8/31	2024/2/22	high
137059	RHEL 8：freerdp (RHSA-2020: 2354)	Nessus	Red Hat Local Security Checks	2020/6/3	2024/11/7	medium
136637	GLSA-202005-07 ：FreeRDP：多個弱點	Nessus	Gentoo Local Security Checks	2020/5/15	2024/3/12	medium
143270	Ubuntu 18.04 LTS：FreeRDP 弱點 (USN-4382-2)	Nessus	Ubuntu Local Security Checks	2020/11/26	2024/8/29	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

high

high

medium

medium

high

medium

medium

high