Heap-based buffer overflow in FreeRDP - CVE-2018-8784
Published: December 18, 2018 / Updated: May 18, 2020
Vulnerability identifier: #VU16591
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8784
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code.
The vulnerability exists due to improper handling of certain stream encodings by the zgfx_decompress_segment() function, as defined in the zgfx.c source code file. A remote attacker can send a specially crafted request that submits malicious input, trigger a heap-based buffer overflow condition that the attacker can use to cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
FreeRDP
freerdp (Ubuntu package)
Opensuse
freerdp (Ubuntu package)
Opensuse
How to mitigate CVE-2018-8784
Update to version 2.0.0-rc4.
FreeRDP - update to 2.0.0 rc4
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1