Heap-based buffer overflow in FreeRDP - CVE-2018-8785

Vulnerability identifier: #VU16590

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8785

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to improper handling of certain stream encodings by the zgfx_decompress() function. A remote attacker can send a specially crafted request that submits malicious input, trigger a heap-based buffer overflow condition that the attacker can use to cause a DoS condition or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

FreeRDP
Ubuntu
Opensuse
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)

Update to version 2.0.0-rc4.

FreeRDP - update to 2.0.0 rc4
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1

• Exploit #2696 - CPR-Zero: CVE-2018-8785 (May 18, 2020)

• https://github.com/FreeRDP/FreeRDP/commit/602f4a2e14b41703b5f431de3154cd46a5750a2d

• Multiple vulnerabilities in FreeRDP
• OpenSUSE Linux update for freerdp
• OpenSUSE Linux update for freerdp
• Ubuntu update for FreeRDP
• Ubuntu update for freerdp, freerdp2