it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Salvatore Bonaccorso <carnil AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 4737-1] xrdp security update
- Date: Wed, 29 Jul 2020 20:27:07 +0000
- List-archive: https://lists.debian.org/msgid-search/E1k0sfL-0007Ja-2m AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version :Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=fKJWAfkULY9tsFeEuhjsZbEM4QG4xLuY/srrOxyY0BA=; b=sv 445QtBVozytJRx4y0oneYX0H5NJ61QDeDl3dyhJTqSpvlZCjeGcpQzB6L1cpqyYmo4uonN1gm3StY Rwf782TCls6bzJDDrxqRkPlNs+JqrTse6Hs5QcYo+YmhK7mEPkWFlvJ1EQ1Y/fcr1DnM8mCHj5Pbi Uus+ET1GeUDNyADDEDoCq7GnaGIwSC5hg20FZjncq151ZC0Vn25cvINY1vqyGPKWNqFIV5BmQLPYm 0vD9rsv4v3L75JaImsUNdpHeEEAZNSypiU+SrdA4K2IfDB/SO5pLx8xSfSSNOs4XLUd+vEdXq5pKL hUThJW+R+HZNZpbOlO2u+D0XHBim4D/w==;
- Old-return-path: <carnil AT seger.debian.org>
- Priority: urgent
- Resent-date: Wed, 29 Jul 2020 20:27:22 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <gTuw1BXhc3I.A.Ot.qudIfB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4737-1 security AT debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 29, 2020 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : xrdp
CVE ID : CVE-2020-4044
Debian Bug : 964573
Ashley Newson discovered that the XRDP sessions manager was susceptible
to denial of service. A local attacker can further take advantage of
this flaw to impersonate the XRDP sessions manager and capture any user
credentials that are submitted to XRDP, approve or reject arbitrary
login credentials or to hijack existing sessions for xorgxrdp sessions.
For the stable distribution (buster), this problem has been fixed in
version 0.9.9-1+deb10u1.
We recommend that you upgrade your xrdp packages.
For the detailed security status of xrdp please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/xrdp
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl8h2zJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qerw//XxRIJXHiGQ6cOSlKAvcVxWHOxueoLEyePlyh01mbtpvp8P10foOhRsgI
wxGODoVjZXU8+Thatj6opcabQisFG1qaf9VO7q2MmJoTU+bDDefkYp3kZIodUTWa
7fH6mu6fb5nVNVjKC1k9uaCf2mm8s+aq8eFst4eSSo/cmFdYXlMk5r+2XOwKdbBw
nvpjqkwxzTRyQu1z4gjyeypJMfNuhdsZ9r1NS5IRlxQazLG6QogkZ2k8BvXqeUR1
JO6K/d3GZGxtPJZuf7RZerExzVFfsoNetZ8ViQqq6LSCcDlgRVNzQf2svf3qj2pV
FHgY0I0QXiY6z87SNd4wVr/zGID8n3IwekoLqDXPohlZiGfBUH9aK5jI7B+ysd66
igDqlNe++ojbWyYAF3oRkEom9BWauAQqcqw4m7jpuuDsOWvwcBIYGQn5VRDcmo1W
1ckoczmK6UYM5PShJGPC7a2fdcMJ3VXAzolzxYTlA6swcNVWlt9rXvzKZMGL5UWW
P+cIwQjvK9t4lwVmwwRxKJWE5CZlgSNTd6j66fud7iNenZJnau0GoYtbkDF91Ik8
4BN25G2glxjksCXZE9Utk2w1BfQMeqUv78ayg7CpDQ+ycCocyq5j85L7x0ywdPac
XzJnAs/3+58sLEoVGH79qae2qFVxCaM5zaWfrTNgyCFSeIUok1Q=
=9u/6
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 4737-1] xrdp security update, Salvatore Bonaccorso, 29.07.2020
Archiv bereitgestellt durch MHonArc 2.6.19.