[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 872-1] xrdp security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : xrdp
Version        : 0.5.0-2+deb7u1
CVE ID         : CVE-2017-6967
Debian Bug     : 858143

It was discovered that xrdp, a Remote Desktop Protocol (RDP) server,
calls the PAM function auth_start_session() in an incorrect location,
leading to PAM session modules not being properly initialized, with a
potential consequence of incorrect configurations or elevation of
privileges, aka a pam_limits.so bypass.

For Debian 7 "Wheezy", these problems have been fixed in version
0.5.0-2+deb7u1.

We recommend that you upgrade your xrdp packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAljYysxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeQtEw/9ELb4QhnsbEjzoh/qYlrQUDFIaWpCmXsv8edULM0+EQj4WDR0xz7vsQS5
+T3bzNTup460Ol3uJK1LMV7ZKWFbQnLpZO7TfJyDNlIcrSLmPtlC4NN+PiipvnNo
SlWX9V5YAgGBRP1Ga9MfOTfVyNa+ibY6kRIyTgJVzd9aC3H6mjx/V8Uvo06lIFGa
Q0eCAvCVoWEx7+xXL/R9Nshsf8rfjtaYIews3zSkEVT6/8TiFiyBUys6GZfR5qlH
CFjB5BQsbDZFg62xvm4coIurp2aDzOs/IsadOc9xbzN+y6U00Zs9xRD2F6BaIla4
E9m5IsZNscmRYfiMXPD1Xle3kQjNpj9Y+7hrIFJlmYgGpTC2w6y2FH96uhs+eE4X
aXX6PVEVgPHvs9aosIRYbjiCjkCUQNCbix9n3DD0CG12LwLajZwVbDY80X5pT1Ja
R22fbMjnkbG5Jg+703mz8+aDRW4h59GoxdYH/bPaLJDMZpeCSeHI3gDipzDrEn+U
/SpoqhMj+B+g3pvHMM2eMbGwlrtWbWGJJkL24EDlxlFRRq2Q4rMMXOlSwctGh4AI
YfN8KqdJ0BPFp+wRZKYWPREB+FQkQ5m/z/AzviE6pxtGGnJ1UhYc9zoGrOq6oKd4
gG2zLStoBn3MkHAkbZj9quEmt1kzszQ9rcpOMbdUy1e39NzbSYk=
=KV5X
-----END PGP SIGNATURE-----


Reply to: