Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3901
freerdp and vinagre security, bug fix, and enhancement update
6 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: freerdp
vinagre
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-13397 CVE-2020-13396 CVE-2020-11526
CVE-2020-11525 CVE-2020-11522 CVE-2020-11089
CVE-2020-11088 CVE-2020-11087 CVE-2020-11086
CVE-2020-11085 CVE-2020-11058 CVE-2020-11049
CVE-2020-11048 CVE-2020-11047 CVE-2020-11046
CVE-2020-11045 CVE-2020-11044 CVE-2020-11043
CVE-2020-11042 CVE-2020-11041 CVE-2020-11040
CVE-2020-11039 CVE-2020-11038 CVE-2020-11019
CVE-2020-11018
Reference: ESB-2020.3398
ESB-2020.2979
ESB-2020.2847
ESB-2020.2611
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:4647
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: freerdp and vinagre security, bug fix, and enhancement update
Advisory ID: RHSA-2020:4647-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4647
Issue date: 2020-11-03
CVE Names: CVE-2020-11018 CVE-2020-11019 CVE-2020-11038
CVE-2020-11039 CVE-2020-11040 CVE-2020-11041
CVE-2020-11042 CVE-2020-11043 CVE-2020-11044
CVE-2020-11045 CVE-2020-11046 CVE-2020-11047
CVE-2020-11048 CVE-2020-11049 CVE-2020-11058
CVE-2020-11085 CVE-2020-11086 CVE-2020-11087
CVE-2020-11088 CVE-2020-11089 CVE-2020-11522
CVE-2020-11525 CVE-2020-11526 CVE-2020-13396
CVE-2020-13397
=====================================================================
1. Summary:
An update for freerdp and vinagre is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP),
released under the Apache license. The xfreerdp client can connect to RDP
servers such as Microsoft Windows machines, xrdp, and VirtualBox.
The vinagre packages provide the Vinagre remote desktop viewer for the
GNOME desktop.
The following packages have been upgraded to a later upstream version:
freerdp (2.1.1). (BZ#1834287)
Security Fix(es):
* freerdp: Out of bound read in cliprdr_server_receive_capabilities
(CVE-2020-11018)
* freerdp: Out of bound read/write in usb redirection channel
(CVE-2020-11039)
* freerdp: out-of-bounds read in update_read_icon_info function
(CVE-2020-11042)
* freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results
function (CVE-2020-11047)
* freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in
winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)
* freerdp: Out-of-bounds read in security_fips_decrypt in
libfreerdp/core/security.c (CVE-2020-13397)
* freerdp: Out of bound read in update_recv could result in a crash
(CVE-2020-11019)
* freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)
* freerdp: Out of bound access in clear_decompress_subcode_rlex
(CVE-2020-11040)
* freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu
(CVE-2020-11041)
* freerdp: out of bound read in rfx_process_message_tileset
(CVE-2020-11043)
* freerdp: double free in update_read_cache_bitmap_v3_order function
(CVE-2020-11044)
* freerdp: out of bounds read in update_read_bitmap_data function
(CVE-2020-11045)
* freerdp: out of bounds seek in update_read_synchronize function could
lead out of bounds read (CVE-2020-11046)
* freerdp: out-of-bounds read could result in aborting the session
(CVE-2020-11048)
* freerdp: out-of-bound read of client memory that is then passed on to the
protocol parser (CVE-2020-11049)
* freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could
lead to out-of-bounds read (CVE-2020-11058)
* freerdp: out-of-bounds read in cliprdr_read_format_list function
(CVE-2020-11085)
* freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge
function (CVE-2020-11086)
* freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
(CVE-2020-11087)
* freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
(CVE-2020-11088)
* freerdp: out-of-bounds read in irp functions (CVE-2020-11089)
* freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)
* freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)
* freerdp: Stream pointer out of bounds in update_recv_secondary_order
could lead out of bounds read later (CVE-2020-11526)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.3 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1761144 - Remove unsupported options from xfreerdp /help
1803054 - SCARD_INSUFFICIENT_BUFFER error when connecting to Windows 10 system
1834287 - Update freerdp to 2.1.1
1835382 - CVE-2020-11042 freerdp: out-of-bounds read in update_read_icon_info function
1835391 - CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function
1835399 - CVE-2020-11045 freerdp: out of bounds read in update_read_bitmap_data function
1835403 - CVE-2020-11046 freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read
1835762 - CVE-2020-11047 freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function
1835766 - CVE-2020-11048 freerdp: out-of-bounds read could result in aborting the session
1835772 - CVE-2020-11049 freerdp: out-of-bound read of client memory that is then passed on to the protocol parser
1835779 - CVE-2020-11058 freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read
1836223 - CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
1836239 - CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
1836247 - CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
1839744 - Rebuild vinagre against new freerdp
1841189 - CVE-2020-13396 freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
1841196 - CVE-2020-13397 freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c
1844161 - CVE-2020-11085 freerdp: out-of-bounds read in cliprdr_read_format_list function
1844166 - CVE-2020-11086 freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function
1844171 - CVE-2020-11087 freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
1844177 - CVE-2020-11088 freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
1844184 - CVE-2020-11089 freerdp: out-of-bounds read in irp functions
1848008 - CVE-2020-11018 freerdp: Out of bound read in cliprdr_server_receive_capabilities
1848012 - CVE-2020-11019 freerdp: Out of bound read in update_recv could result in a crash
1848018 - CVE-2020-11038 freerdp: Integer overflow in VIDEO channel
1848022 - CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
1848029 - CVE-2020-11040 freerdp: Out of bound access in clear_decompress_subcode_rlex
1848034 - CVE-2020-11041 freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu
1848038 - CVE-2020-11043 freerdp: out of bound read in rfx_process_message_tileset
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
freerdp-2.1.1-1.el8.src.rpm
vinagre-3.22.0-23.el8.src.rpm
aarch64:
freerdp-2.1.1-1.el8.aarch64.rpm
freerdp-debuginfo-2.1.1-1.el8.aarch64.rpm
freerdp-debugsource-2.1.1-1.el8.aarch64.rpm
freerdp-libs-2.1.1-1.el8.aarch64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-2.1.1-1.el8.aarch64.rpm
libwinpr-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-devel-2.1.1-1.el8.aarch64.rpm
vinagre-3.22.0-23.el8.aarch64.rpm
vinagre-debuginfo-3.22.0-23.el8.aarch64.rpm
vinagre-debugsource-3.22.0-23.el8.aarch64.rpm
ppc64le:
freerdp-2.1.1-1.el8.ppc64le.rpm
freerdp-debuginfo-2.1.1-1.el8.ppc64le.rpm
freerdp-debugsource-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-2.1.1-1.el8.ppc64le.rpm
libwinpr-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-devel-2.1.1-1.el8.ppc64le.rpm
vinagre-3.22.0-23.el8.ppc64le.rpm
vinagre-debuginfo-3.22.0-23.el8.ppc64le.rpm
vinagre-debugsource-3.22.0-23.el8.ppc64le.rpm
s390x:
freerdp-2.1.1-1.el8.s390x.rpm
freerdp-debuginfo-2.1.1-1.el8.s390x.rpm
freerdp-debugsource-2.1.1-1.el8.s390x.rpm
freerdp-libs-2.1.1-1.el8.s390x.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-2.1.1-1.el8.s390x.rpm
libwinpr-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-devel-2.1.1-1.el8.s390x.rpm
vinagre-3.22.0-23.el8.s390x.rpm
vinagre-debuginfo-3.22.0-23.el8.s390x.rpm
vinagre-debugsource-3.22.0-23.el8.s390x.rpm
x86_64:
freerdp-2.1.1-1.el8.x86_64.rpm
freerdp-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-debuginfo-2.1.1-1.el8.x86_64.rpm
freerdp-debugsource-2.1.1-1.el8.i686.rpm
freerdp-debugsource-2.1.1-1.el8.x86_64.rpm
freerdp-libs-2.1.1-1.el8.i686.rpm
freerdp-libs-2.1.1-1.el8.x86_64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-2.1.1-1.el8.i686.rpm
libwinpr-2.1.1-1.el8.x86_64.rpm
libwinpr-debuginfo-2.1.1-1.el8.i686.rpm
libwinpr-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-devel-2.1.1-1.el8.i686.rpm
libwinpr-devel-2.1.1-1.el8.x86_64.rpm
vinagre-3.22.0-23.el8.x86_64.rpm
vinagre-debuginfo-3.22.0-23.el8.x86_64.rpm
vinagre-debugsource-3.22.0-23.el8.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64:
freerdp-debuginfo-2.1.1-1.el8.aarch64.rpm
freerdp-debugsource-2.1.1-1.el8.aarch64.rpm
freerdp-devel-2.1.1-1.el8.aarch64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-debuginfo-2.1.1-1.el8.aarch64.rpm
ppc64le:
freerdp-debuginfo-2.1.1-1.el8.ppc64le.rpm
freerdp-debugsource-2.1.1-1.el8.ppc64le.rpm
freerdp-devel-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-debuginfo-2.1.1-1.el8.ppc64le.rpm
s390x:
freerdp-debuginfo-2.1.1-1.el8.s390x.rpm
freerdp-debugsource-2.1.1-1.el8.s390x.rpm
freerdp-devel-2.1.1-1.el8.s390x.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-debuginfo-2.1.1-1.el8.s390x.rpm
x86_64:
freerdp-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-debuginfo-2.1.1-1.el8.x86_64.rpm
freerdp-debugsource-2.1.1-1.el8.i686.rpm
freerdp-debugsource-2.1.1-1.el8.x86_64.rpm
freerdp-devel-2.1.1-1.el8.i686.rpm
freerdp-devel-2.1.1-1.el8.x86_64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-debuginfo-2.1.1-1.el8.i686.rpm
libwinpr-debuginfo-2.1.1-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-11018
https://access.redhat.com/security/cve/CVE-2020-11019
https://access.redhat.com/security/cve/CVE-2020-11038
https://access.redhat.com/security/cve/CVE-2020-11039
https://access.redhat.com/security/cve/CVE-2020-11040
https://access.redhat.com/security/cve/CVE-2020-11041
https://access.redhat.com/security/cve/CVE-2020-11042
https://access.redhat.com/security/cve/CVE-2020-11043
https://access.redhat.com/security/cve/CVE-2020-11044
https://access.redhat.com/security/cve/CVE-2020-11045
https://access.redhat.com/security/cve/CVE-2020-11046
https://access.redhat.com/security/cve/CVE-2020-11047
https://access.redhat.com/security/cve/CVE-2020-11048
https://access.redhat.com/security/cve/CVE-2020-11049
https://access.redhat.com/security/cve/CVE-2020-11058
https://access.redhat.com/security/cve/CVE-2020-11085
https://access.redhat.com/security/cve/CVE-2020-11086
https://access.redhat.com/security/cve/CVE-2020-11087
https://access.redhat.com/security/cve/CVE-2020-11088
https://access.redhat.com/security/cve/CVE-2020-11089
https://access.redhat.com/security/cve/CVE-2020-11522
https://access.redhat.com/security/cve/CVE-2020-11525
https://access.redhat.com/security/cve/CVE-2020-11526
https://access.redhat.com/security/cve/CVE-2020-13396
https://access.redhat.com/security/cve/CVE-2020-13397
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX6I0INzjgjWX9erEAQh3aA//RtOjgT5U/N0RZODK/NW0Ie1HZFE1NIlA
P6lqlGko8xf7ojkAfzKYqsfipMmencaYrVc0dqCUd5WoJttkVQzWpsTZb8qDaCW8
Q7ps0gwyLYZnTCFc1j0NYV35E8tSoyRj+IkDTdpTiSQlr6+bczxhIILqi1hoM3fa
IJ91rqM4JzhXlFzOZMMi+xCHVxoszrbFf2ivJkCr9esJF+4N0R1ec31JhtxPEcc7
rG5eB1c3sIoKeIn4PYJ9duj6i+0AOcBuhbFArXqE1aPy/InfVaQltgwzR1ZF9HVS
SFompoeTPs6iEp0KpcoM7xNtGeUO50OhR3j2NRseiS72+TB+N3091wwHBWZ1n7Jb
SWCV1ZduvfQcnIWRMUjtgk5lPzuRTvotip/BwOaaKMOs7Xzh7Y6wvlIbFMDWt2YY
V5qbxKG32Zt53Sq9m8KJ15aRKJt5K1UdPDV6KnKzjHATcIazWyCWhy5c/T5zWcMq
qk+dmZv8/EA4pKaXYxkG836ZTccOftXAM3U6zUfB60Bm5ehXR45HRRuZub4C97to
+eP+HvgIR5+mCO62hEZfjnC8c4mJIryJaAWnb8hpaQgWXZnTdEl4oQAh/zIJl61X
BkYiCJ0fgTO6D7CGe72mORCx1FQ7Sjq1chhqpl8CZQKLaqJx1xbJ2ZZwuhg5OriJ
FwblVM9hMdA=
=mptC
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX6TFw+NLKJtyKPYoAQgLwBAApKDeLOTBCoFIQePJCGD7guuIekLeAcVP
3gq4wikveS8qkUzu3xV0SPbchksON0cJHmaiAj4GoxTO+RZbvqENgykcHGRj4AwI
AFsL6o5hZPtKMSCsENsEdW0NJT3lpn9erBEG+sNrNXcM/F9+7uzz0gf0n3iBjRPY
LdyZlJl47nFR5UB7c7iYwSSReL389/xe0D8CHJohiqYcSqyi5e+m7qY/fJLr5JQC
YXKQWZaotkG3UDEVigwWpye7P8dGKz6iSWkfY7HCzhQ5JpsoKeK/uo3VlQ4+P1cI
Moush+ybAOwME1i4ueWtFK5SZMvmhsVZpE23Cw1OpKnl+l2wgDowVTexZETMPf88
3Auh8MDJWru1WO4CixEPzu3ZqvAqWoTTGK36sHw2WnCeAwLuUQRMojqgosvw2Djf
/YBGIVl2kvgEzICQAovJYbmkv5vcr8o4hotcxE71x94dtAnOHQTl9OdUpjGJcGfK
AokzRn2HEGASaoDQ7G0WzKlVk7yBXtes5wykKc0aEL+Pfczku31iz/WeekefVb0U
Obk0dGCt8Qt6xfsDCinialw3u5+Z6H+YSq9wWn4108gR9CB2OrIhIKh696f40XGl
7lbr9l/miTnGyvjBpB00DzkLbQNgcuy8/8ObKx0+nmg3BmyAwk7sIIEHjTx95zPC
bPuhpPylT6g=
=d7Vt
-----END PGP SIGNATURE-----