Bugzilla – Bug 1069591
VUL-0: CVE-2017-16927: xrdp: Buffer-overflow in scp_v0s_accept function in session manager
Last modified: 2022-10-04 09:54:06 UTC
rh#1516759 The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. Upstream patch: https://github.com/neutrinolabs/xrdp/pull/958/commits/ebd0510a7d4dab906b6e01570205dfa530d1f7bf References: https://groups.google.com/forum/#!topic/xrdp-devel/PmVfMuy_xBA References: https://bugzilla.redhat.com/show_bug.cgi?id=1516759 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16927 http://seclists.org/oss-sec/2017/q4/317
seems in all xrdp versions we have.
Please submit for this to SUSE:SLE-12-SP2:Update. Thanks
SUSE-SU-2019:1847-1: An update that solves three vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1014524,1015567,1029912,1060644,1069591,1090174,1100453,1101506 CVE References: CVE-2013-1430,CVE-2017-16927,CVE-2017-6967 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): xrdp-0.9.0~git.1456906198.f422461-21.9.1 SUSE Linux Enterprise Desktop 12-SP4 (src): xrdp-0.9.0~git.1456906198.f422461-21.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixed
SUSE-SU-2019:1860-1: An update that solves three vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1014524,1015567,1022098,1023988,1029912,1060644,1069591,1090174,1100453,1101506 CVE References: CVE-2013-1430,CVE-2017-16927,CVE-2017-6967 Sources used: SUSE OpenStack Cloud 7 (src): xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server for SAP 12-SP2 (src): xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Linux Enterprise Server 12-SP2-LTSS (src): xrdp-0.9.0~git.1456906198.f422461-16.9.3 SUSE Enterprise Storage 4 (src): xrdp-0.9.0~git.1456906198.f422461-16.9.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
this is actually needed for SUSE:SLE-11-SP3:Update instead of SUSE:SLE-11-SP4:Update. SUSE:SLE-11-SP4:Update is already EOL.
done