Integer overflow in FreeRDP - CVE-2018-8787
Published: December 18, 2018 / Updated: May 18, 2020
Vulnerability identifier: #VU16593
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8787
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code.
The vulnerability exists due to integer overflow condition that exists in the gdi_Bitmap_Decompress() function, as defined in the graphics.c source code file. A remote attacker can send a specially crafted request that submits malicious input, trigger a heap-based buffer overflow condition that the attacker can use to cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
FreeRDP
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Ubuntu
Opensuse
freerdp (Alpine package)
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Ubuntu
Opensuse
freerdp (Alpine package)
libfreerdp1 (Ubuntu package)
freerdp (Ubuntu package)
libfreerdp-client1.1 (Ubuntu package)
libfreerdp2-2 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
How to mitigate CVE-2018-8787
Update to version 2.0.0-rc4.
FreeRDP - update to 2.0.0 rc4
freerdp (Alpine package) - addressed in versions 2.0.0_rc4-r0, 2.0.0-r0
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
freerdp (Alpine package) - addressed in versions 2.0.0_rc4-r0, 2.0.0-r0
libfreerdp1 (Ubuntu package) - update to 1.0.2-2ubuntu1.2
freerdp (Ubuntu package) - addressed in versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1, 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
libfreerdp-client1.1 (Ubuntu package) - update to 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1, 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1