=====================================================================

                               CERT-Renater

                    Note d'Information No. 2023/VULN213

_____________________________________________________________________

DATE                : 08/06/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Guacamole versions prior
                                       to 1.5.2.

=====================================================================
https://lists.apache.org/thread/vgtvxb3w7mm84hx6v8dfc0onsoz05gb6
https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownv
_____________________________________________________________________

[SECURITY] CVE-2023-30576: Apache Guacamole: Use-after-free in
handling of RDP audio input buffer

Posted to announce@guacamole.apache.org
Michael Jumper - mardi 6 juin 2023 19:12:29 UTC+2

Severity: moderate
Base CVSS Score: 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)


Affected versions:

- Apache Guacamole 0.9.10 through 1.5.1


Description:

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a
freed RDP audio input buffer. Depending on timing, this may allow
an attacker to execute arbitrary code with the privileges of the
guacd process.


Mitigation:

Users of versions of Apache Guacamole 1.5.1 and older should upgrade
to the the 1.5.2 release.


Credit:

We would like to thank Stefan Schiller (Sonar) for reporting this
issue.


References:

https://guacamole.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-30576


Timeline:

2023-04-11: Reported to security@guacamole.apache.org
2023-04-11: Report acknowledged by project
2023-04-12: Report confirmed by project
2023-05-09: Fix completed and merged
2023-05-09: Fix tested and confirmed by reporter
2023-05-25: Fix released

_____________________________________________________________________


[SECURITY] CVE-2023-30575: Apache Guacamole: Incorrect calculation
of Guacamole protocol element lengths

Posted to announce@guacamole.apache.org
Michael Jumper - mardi 6 juin 2023 19:12:15 UTC+2

Severity: moderate
Base CVSS Score: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)


Affected versions:

- Apache Guacamole through 1.5.1


Description:

Apache Guacamole 1.5.1 and older may incorrectly calculate the
lengths of instruction elements sent during the Guacamole protocol
handshake, potentially allowing an attacker to inject Guacamole
instructions during the handshake through specially-crafted data.


Mitigation:

Users of versions of Apache Guacamole 1.5.1 and older should upgrade
to the 1.5.2 release.


Credit:

We would like to thank Stefan Schiller (Sonar) for reporting this
issue.


References:

https://guacamole.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-30575


Timeline:

2023-04-11: Reported to security@guacamole.apache.org
2023-04-11: Report acknowledged by project
2023-04-12: Report confirmed by project
2023-05-09: Fix completed and merged
2023-05-09: Fix tested and confirmed by reporter
2023-05-25: Fix released


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================