Bug 25274 - rdesktop security issues
Summary: rdesktop security issues
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6TOO MGA7-64-OK MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-08-11 22:40 CEST by David Walser
Modified: 2019-09-06 23:11 CEST (History)
6 users (show)

See Also:
Source RPM: rdesktop-1.8.5-1.mga7.src.rpm
CVE:
Status comment: Fixed upstream in 1.8.6


Attachments

Description David Walser 2019-08-11 22:40:49 CEST
+++ This bug was initially created as a clone of Bug #24797 +++

We need to do this dance again:
https://github.com/rdesktop/rdesktop/releases/tag/v1.8.6
Comment 1 David Walser 2019-08-11 22:41:21 CEST
Debian has issued an advisory for this on June 28:
https://www.debian.org/security/2019/dsa-4473

Status comment: (none) => Fixed upstream in 1.8.6
Whiteboard: (none) => MGA6TOO

Comment 2 Stig-Ørjan Smelror 2019-08-11 22:49:30 CEST
Advisory
========

An issue was discovered soon after release of version 1.8.5 where it was impossible to connect to some servers. This issue has now been fixed.

References
==========

https://github.com/rdesktop/rdesktop/releases/tag/v1.8.6
https://www.debian.org/security/2019/dsa-4473

Files
=====

Uploaded to core/updates_testing

rdesktop-1.8.6-1.mga7

from rdesktop-1.8.6-1.mga7.src.rpm

Assignee: smelror => qa-bugs

Comment 3 David Walser 2019-08-11 22:50:23 CEST
You missed Mageia 6.

Assignee: qa-bugs => smelror

Comment 4 Stig-Ørjan Smelror 2019-08-11 22:52:26 CEST
Advisory
========

An issue was discovered soon after release of version 1.8.5 where it was impossible to connect to some servers. This issue has now been fixed.

References
==========

https://github.com/rdesktop/rdesktop/releases/tag/v1.8.6
https://www.debian.org/security/2019/dsa-4473

Files
=====

Uploaded to core/updates_testing

rdesktop-1.8.6-1.mga6

from rdesktop-1.8.6-1.mga6.src.rpm
David Walser 2019-08-11 22:57:09 CEST

Assignee: smelror => qa-bugs
CC: (none) => smelror

Comment 5 José Jorge 2019-08-20 08:39:28 CEST
Tested with MGA7 x86_64, connection to two W2008R2 servers I have. All Ok.

Whiteboard: MGA6TOO => MGA6TOO MGA7-64-OK
CC: (none) => lists.jjorge

Comment 6 Len Lawrence 2019-09-04 20:01:40 CEST
No luck here - calling on other QA testers to look at this one.

mga6, x86_64

Updated rdesktop on local machine.

As far as I can make out from previous bug reports xrdp emulates the behaviour of a Windows remote desktop server.
Installed xrdp on remote host canopus and started the xrdp service.
Installation resulted in the writing of '/etc/pki/tls/private/xrdp.pem'.

Back on the local machine:
$ rdesktop -u lcl -d difda canopus:3389
Autoselected keyboard map en-gb
Connection established using SSL.
ERROR: SSL_write: 1 (Success)

No gui.
No idea what the ERROR message means.

$ rdesktop server
Autoselected keyboard map en-gb
ERROR: server: unable to connect

$ rdesktop -u lcl -d localhost canopus:3389
Autoselected keyboard map en-gb
Connection established using SSL.
ERROR: SSL_write: 1 (Success)

No gui.

$ rdesktop -u lcl -d localhost -n canopus server
Autoselected keyboard map en-gb
ERROR: server: unable to connect

$ rdesktop canopus:3389
Autoselected keyboard map en-gb
Connection established using SSL.
ERROR: SSL_write: 1 (Success)

$ rdesktop -p - canopus:3389
Autoselected keyboard map en-gb
Password: 
Connection established using SSL.
ERROR: SSL_write: 1 (Success)

This looks like a regression.  In previous incarnations it was possible to raise the gui with at least one of the above commands.

Or does the local host have to have a copy of the PEM certificate?  My ignorance of SSL is profound.

CC: (none) => tarazed25

Comment 7 José Jorge 2019-09-04 21:17:30 CEST
(In reply to Len Lawrence from comment #6)
 > This looks like a regression.  In previous incarnations it was possible to
> raise the gui with at least one of the above commands.

I'd say we should only compare current MGA7 version with update. If the regression is already there, the update does not change anything.

As I've said in comment 5, I have tested against real Windows servers and it works.
Comment 8 Herman Viaene 2019-09-06 11:45:27 CEST
MGA6-64 Plasma on Lenovo B50
No installation issues
$ rdesktop <win10ipaddress>
Autoselected keyboard map nl-be
ERROR: <win10ipaddress>: unable to connect

and that is correct since it is a Windows 10 Home and that one blocks off rdp.
There is an RDP Wrapper on Win, but since the last update of Win10Home, it even blocks the installation of this tool off.
With José's test on M7, I think we better let the update go for M6 on a clean install.

CC: (none) => herman.viaene
Whiteboard: MGA6TOO MGA7-64-OK => MGA6TOO MGA7-64-OK MGA6-64-OK

Thomas Backlund 2019-09-06 20:19:01 CEST

Keywords: (none) => advisory, validated_update
CC: (none) => tmb, sysadmin-bugs

Comment 9 Mageia Robot 2019-09-06 23:11:16 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0247.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.