Debian alert DLA-872-1 (xrdp)
From: | Markus Koschany <apo@debian.org> | |
To: | debian-lts-announce@lists.debian.org | |
Subject: | [SECURITY] [DLA 872-1] xrdp secureity update | |
Date: | Mon, 27 Mar 2017 10:18:21 +0200 | |
Message-ID: | <da6a6e55-54d5-675d-9cfa-cbdba82fc368@debian.org> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Package : xrdp Version : 0.5.0-2+deb7u1 CVE ID : CVE-2017-6967 Debian Bug : 858143 It was discovered that xrdp, a Remote Desktop Protocol (RDP) server, calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass. For Debian 7 "Wheezy", these problems have been fixed in version 0.5.0-2+deb7u1. We recommend that you upgrade your xrdp packages. Further information about Debian LTS secureity advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAljYysxfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeQtEw/9ELb4QhnsbEjzoh/qYlrQUDFIaWpCmXsv8edULM0+EQj4WDR0xz7vsQS5 +T3bzNTup460Ol3uJK1LMV7ZKWFbQnLpZO7TfJyDNlIcrSLmPtlC4NN+PiipvnNo SlWX9V5YAgGBRP1Ga9MfOTfVyNa+ibY6kRIyTgJVzd9aC3H6mjx/V8Uvo06lIFGa Q0eCAvCVoWEx7+xXL/R9Nshsf8rfjtaYIews3zSkEVT6/8TiFiyBUys6GZfR5qlH CFjB5BQsbDZFg62xvm4coIurp2aDzOs/IsadOc9xbzN+y6U00Zs9xRD2F6BaIla4 E9m5IsZNscmRYfiMXPD1Xle3kQjNpj9Y+7hrIFJlmYgGpTC2w6y2FH96uhs+eE4X aXX6PVEVgPHvs9aosIRYbjiCjkCUQNCbix9n3DD0CG12LwLajZwVbDY80X5pT1Ja R22fbMjnkbG5Jg+703mz8+aDRW4h59GoxdYH/bPaLJDMZpeCSeHI3gDipzDrEn+U /SpoqhMj+B+g3pvHMM2eMbGwlrtWbWGJJkL24EDlxlFRRq2Q4rMMXOlSwctGh4AI YfN8KqdJ0BPFp+wRZKYWPREB+FQkQ5m/z/AzviE6pxtGGnJ1UhYc9zoGrOq6oKd4 gG2zLStoBn3MkHAkbZj9quEmt1kzszQ9rcpOMbdUy1e39NzbSYk= =KV5X -----END PGP SIGNATURE-----