Reachable assertion in FreeRDP - #VU156167

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by terminating the FreeRDP client process.

The vulnerability exists due to a reachable assertion in FreeRDP's ARM gateway response handling when processing an HTTP 200 JSON response with a missing or non-string redirectedServerCert field. A remote attacker can return such a response from a gateway selected by the victim to pass a null buffer to the target-certificate parser, trigger an assertion, and terminate the client process.

Exploitation requires a client built with WITH_AAD=ON; the default AAD-disabled build does not compile the ARM gateway route.

Affected software

Remediation

External References

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hqf8-95c7-6r92

Related Security Bulletins

• Multiple vulnerabilities in FreeRDP