Bug 1015567 (CVE-2013-1430) - VUL-0: CVE-2013-1430: xrdp: xrdp create ~/.vnc/sesman_${username}_passwd with (equivalent of) cleartext password of user
Summary: VUL-0: CVE-2013-1430: xrdp: xrdp create ~/.vnc/sesman_${username}_passwd with...
Status: RESOLVED FIXED
Alias: CVE-2013-1430
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/177538/
Whiteboard: CVSSv2:SUSE:CVE-2013-1430:1.5:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-14 16:01 UTC by Marcus Meissner
Modified: 2024-05-07 15:58 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-12-14 16:01:37 UTC 
UBUNTU:CVE-2013-1430

https://github.com/neutrinolabs/xrdp/pull/497

This fixes an old VNC security issue were the VNC password file is based on the user password.
Now it is derived from a random GUID that is generated for each session.
This GUID can be used in the future for session reconnect and other things.

References:
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1430.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1430
Comment 1 Swamp Workflow Management 2016-12-14 23:03:38 UTC 
bugbot adjusting priority
Comment 15 Swamp Workflow Management 2019-07-15 16:11:39 UTC 
SUSE-SU-2019:1847-1: An update that solves three vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1014524,1015567,1029912,1060644,1069591,1090174,1100453,1101506
CVE References: CVE-2013-1430,CVE-2017-16927,CVE-2017-6967
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    xrdp-0.9.0~git.1456906198.f422461-21.9.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    xrdp-0.9.0~git.1456906198.f422461-21.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Felix Zhang 2019-07-16 03:32:13 UTC 
Fixed
Comment 17 Swamp Workflow Management 2019-07-16 19:10:45 UTC 
SUSE-SU-2019:1860-1: An update that solves three vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1014524,1015567,1022098,1023988,1029912,1060644,1069591,1090174,1100453,1101506
CVE References: CVE-2013-1430,CVE-2017-16927,CVE-2017-6967
Sources used:
SUSE OpenStack Cloud 7 (src):    xrdp-0.9.0~git.1456906198.f422461-16.9.3
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    xrdp-0.9.0~git.1456906198.f422461-16.9.3
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    xrdp-0.9.0~git.1456906198.f422461-16.9.3
SUSE Enterprise Storage 4 (src):    xrdp-0.9.0~git.1456906198.f422461-16.9.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Robert Frohl 2022-07-07 13:38:58 UTC 
this is actually needed for SUSE:SLE-11-SP3:Update instead of SUSE:SLE-11-SP4:Update. SUSE:SLE-11-SP4:Update is already EOL.