CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
29.7%
The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2537 advisory.
2024-06-06: CVE-2024-32660 was added to this advisory.
FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability. (CVE-2024-22211)
Integer overflow & OutOfBound Write in clear_decompress_residual_data
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32039)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`). (CVE-2024-32040)
OutOfBound Read in zgfx_decompress_segment
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32041)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
(CVE-2024-32458)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)
OutOfBound Read in interleaved_decompress
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32460)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available. (CVE-2024-32659)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available. (CVE-2024-32660)
Tenable has extracted the preceding description block directly from the tested product security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2024-2537.
##
include('compat.inc');
if (description)
{
script_id(197113);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/10");
script_cve_id(
"CVE-2024-22211",
"CVE-2024-32039",
"CVE-2024-32040",
"CVE-2024-32041",
"CVE-2024-32458",
"CVE-2024-32459",
"CVE-2024-32460",
"CVE-2024-32659",
"CVE-2024-32660"
);
script_xref(name:"IAVA", value:"2024-A-0259");
script_name(english:"Amazon Linux 2 : freerdp (ALAS-2024-2537)");
script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
script_set_attribute(attribute:"description", value:
"The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2024-2537 advisory.
2024-06-06: CVE-2024-32660 was added to this advisory.
FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions
an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects
FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server
could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out
of bound read/write. Data extraction over network is not possible, the buffers are used to display an
image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are
no know workarounds for this vulnerability. (CVE-2024-22211)
Integer overflow & OutOfBound Write in clear_decompress_residual_data
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32039)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version
of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable
to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec
(e.g. use `-nsc`). (CVE-2024-32040)
OutOfBound Read in zgfx_decompress_segment
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32041)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version
of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch
the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
(CVE-2024-32458)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that
use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and
2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)
OutOfBound Read in interleaved_decompress
NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32460)
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version
3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains
a patch for the issue. No known workarounds are available. (CVE-2024-32659)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious
server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a
patch for the issue. No known workarounds are available. (CVE-2024-32660)
Tenable has extracted the preceding description block directly from the tested product security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/AL2/ALAS-2024-2537.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-22211.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32039.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32040.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32041.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32458.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32459.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32460.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32659.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-32660.html");
script_set_attribute(attribute:"solution", value:
"Run 'yum update freerdp' to update your system.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-22211");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/19");
script_set_attribute(attribute:"patch_publication_date", value:"2024/05/09");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/15");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-devel");
script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Amazon Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
exit(0);
}
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
if (os_ver == 'A') os_ver = 'AMI';
audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}
if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var pkgs = [
{'reference':'freerdp-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-debuginfo-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-devel-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-devel-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-devel-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-libs-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-libs-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'freerdp-libs-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-devel-2.11.7-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-devel-2.11.7-1.amzn2.0.1', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libwinpr-devel-2.11.7-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freerdp / freerdp-debuginfo / freerdp-devel / etc");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22211
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32039
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32040
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32041
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32458
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32459
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32460
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32659
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32660
alas.aws.amazon.com/AL2/ALAS-2024-2537.html
alas.aws.amazon.com/cve/html/CVE-2024-22211.html
alas.aws.amazon.com/cve/html/CVE-2024-32039.html
alas.aws.amazon.com/cve/html/CVE-2024-32040.html
alas.aws.amazon.com/cve/html/CVE-2024-32041.html
alas.aws.amazon.com/cve/html/CVE-2024-32458.html
alas.aws.amazon.com/cve/html/CVE-2024-32459.html
alas.aws.amazon.com/cve/html/CVE-2024-32460.html
alas.aws.amazon.com/cve/html/CVE-2024-32659.html
alas.aws.amazon.com/cve/html/CVE-2024-32660.html
alas.aws.amazon.com/faqs.html
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
29.7%