FreeRDP up to 2.10.x/3.0.0-beta2 gdi_multi_opaque_rect out-of-bounds

Summaryinfo

A vulnerability was found in FreeRDP up to 2.10.x/3.0.0-beta2. It has been rated as problematic. This impacts the function gdi_multi_opaque_rect. The manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2023-39356. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in FreeRDP up to 2.10.x/3.0.0-beta2. This issue affects the function gdi_multi_opaque_rect. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was released 09/01/2023 as GHSA-q5v5-qhj5-mh6m. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-39356 since 07/28/2023. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 216351 (Debian dla-4053 : freerdp2-dev - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.11.0 or 3.0.0-beta3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216351). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 3.0.0-beta1
• 3.0.0-beta2

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion