このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-109949 の詳細 →
UBUNTU-CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:16.04:LTS
freerdp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
freerdp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-0ubuntu0.24.04.1"}]}]
Ubuntu:Pro:24.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-0ubuntu0.26.04.1"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report github.com
- report vulncheck.com