Heap-based buffer overflow in FreeRDP - CVE-2018-8784
Published: December 18, 2018 / Updated: May 18, 2020
Vulnerability identifier: #VU16591
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8784
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code.
The vulnerability exists due to improper handling of certain stream encodings by the zgfx_decompress_segment() function, as defined in the zgfx.c source code file. A remote attacker can send a specially crafted request that submits malicious input, trigger a heap-based buffer overflow condition that the attacker can use to cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
FreeRDP
Ubuntu
Opensuse
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)
Ubuntu
Opensuse
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)
How to mitigate CVE-2018-8784
Update to version 2.0.0-rc4.
FreeRDP - update to 2.0.0 rc4
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1