Out-of-bounds write in FreeRDP - CVE-2018-8788

Vulnerability identifier: #VU16589

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8788

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to out-of-bounds write condition in the nsc_rle_decode() function, as defined in the nsc.c source code file. A remote attacker can send a specially crafted request that submits malicious input, trigger a heap-based buffer overflow condition that the attacker can use to cause a DoS condition or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

FreeRDP
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Ubuntu
Opensuse
freerdp (Alpine package)
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)

Update to version 2.0.0-rc4.

FreeRDP - update to 2.0.0 rc4
freerdp (Alpine package) - update to 2.0.0_rc4-r0
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1

• Exploit #2699 - CPR-Zero: CVE-2018-8788 (May 18, 2020)

• https://github.com/FreeRDP/FreeRDP/commit/d1112c279bd1a327e8e4d0b5f371458bf2579659

• Multiple vulnerabilities in FreeRDP
• OpenSUSE Linux update for freerdp
• OpenSUSE Linux update for freerdp
• Ubuntu update for FreeRDP
• Red Hat update for freerdp
• Out-of-bounds write in freerdp (Alpine package)
• Ubuntu update for freerdp, freerdp2