CVE-2017-2837

An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle attack to trigger this vulnerability (CVE-2017-2834).

An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to trigger this vulnerability (CVE-2017-2835).

An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability (CVE-2017-2836).

An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability (CVE-2017-2837).

An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability (CVE-2017-2838, CVE-2017-2839).

These are all security issues fixed in the freerdp-2.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

• CVE-2017-2834: Out-of-bounds write in license_recv() (bsc#1050714)

• CVE-2017-2835: Out-of-bounds write in rdp_recv_tpkt_pdu (bsc#1050712)

• CVE-2017-2836: Rdp Client Read Server Proprietary Certificate Denial of Service (bsc#1050699)

• CVE-2017-2837: Client GCC Read Server Security Data DoS (bsc#1050704)

• CVE-2017-2838: Client License Read Product Info Denial of Service Vulnerability (bsc#1050708)

• CVE-2017-2839: Client License Read Challenge Packet Denial of Service (bsc#1050711)

This update for freerdp fixes the following issues:

freerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006):

• CVE-2020-11017: Fixed a double free which could have denied the server's service.
• CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have triggered.
• CVE-2020-11019: Fixed an issue which could have led to denial of service if logger was set to 'WLOG_TRACE'.
• CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.
• CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory read and write when USB redirection was enabled.
• CVE-2020-11040: Fixed an out of bounds data read in clear_decompress_subcode_rlex.
• CVE-2020-11041: Fixed an issue with the configuration for sound backend which could have led to server's denial of service.
• CVE-2020-11043: Fixed an out of bounds read in rfx_process_message_tileset.
• CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.
• CVE-2020-11086: Fixed an out of bounds read in ntlm_read_ntlm_v2_client_challenge.
• CVE-2020-11087: Fixed an out of bounds read in ntlm_read_AuthenticateMessage.
• CVE-2020-11088: Fixed an out of bounds read in ntlm_read_NegotiateMessage.
• CVE-2020-11089: Fixed an out of bounds read in irp function family.
• CVE-2020-11095: Fixed a global out of bounds read in update_recv_primary_order.
• CVE-2020-11096: Fixed a global out of bounds read in update_read_cache_bitmap_v3_order.
• CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.
• CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.
• CVE-2020-11099: Fixed an out of bounds Read in license_read_new_or_upgrade_license_packet.
• CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).
• CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).
• CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).
• CVE-2020-11524: Fixed an out of bounds write in interleaved.c (bsc#1171446).
• CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).
• CVE-2020-11526: Fixed an out of bounds read in update_recv_secondary_order (bsc#1171674).
• CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.
• CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due to uninitialized value.
• CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.
• CVE-2020-4030: Fixed an out of bounds read in TrioParse.
• CVE-2020-4031: Fixed a use after free in gdi_SelectObject.
• CVE-2020-4032: Fixed an integer casting in update_recv_secondary_order.
• CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.
• Fixed an issue where freerdp failed with -fno-common (bsc#1169748).
• Fixed an issue where USB redirection with FreeRDP was not working (bsc#1169679).
• Fixed an issue where freerdp could not start (bsc#1129193).
• Fixed an issue where copy and paste between remote host was transforming text to chinese (bsc#1004108).
• Added pulse support (bsc#1090677).

Additionally, the following issue was fixed:

• CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).

It was discovered that FreeRDP incorrectly handled certain width and height values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-0250)

It was discovered that FreeRDP incorrectly handled certain values in a Scope List. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0791)

Tyler Bohan discovered that FreeRDP incorrectly handled certain length values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-2834, CVE-2017-2835)

Tyler Bohan discovered that FreeRDP incorrectly handled certain packets. A malicious server could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service. (CVE-2017-2836, CVE-2017-2837, CVE-2017-2838, CVE-2017-2839)