FreeRDP up to 2.1.2 rdpegfx Channel integer overflow

Summaryinfo

A vulnerability was found in FreeRDP up to 2.1.2. It has been rated as problematic. This vulnerability affects unknown code of the component rdpegfx Channel Handler. This manipulation causes integer overflow. The identification of this vulnerability is CVE-2020-15103. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in FreeRDP up to 2.1.2. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component rdpegfx Channel Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-680. The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow. As an impact it is known to affect availability. The summary by CVE is:

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto

The weakness was shared 07/27/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2020-15103 since 06/25/2020. The attack can be launched remotely. The successful exploitation requires a single authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236628 (Alibaba Cloud Linux 3 : 0002: freerdp (ALINUX3-SA-2022:0002)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236628). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 2.1.0
• 2.1.1
• 2.1.2

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion