CVE-2023-40589

EUVD-2023-45149

31.08.2023, 19:15

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Classic Buffer Overflow

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
GitHub_M	CNA	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 34%

Affected Products (NVD)

Vendor	Product	Version
freerdp	freerdp	𝑥 < 2.11.0
freerdp	freerdp	3.0.0:beta1
freerdp	freerdp	3.0.0:beta2
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freerdp2

bookworm	no-dsa
bullseye	no-dsa
sid	2.11.7+dfsg1-6 fixed
trixie	2.11.7+dfsg1-6 fixed

Ubuntu Releases

Ubuntu Product

Codename

freerdp2

bionic	Fixed 2.2.0+dfsg1-0ubuntu0.18.04.4+esm1 released
focal	Fixed 2.2.0+dfsg1-0ubuntu0.20.04.5 released
jammy	Fixed 2.6.1+dfsg1-3ubuntu2.4 released
lunar	Fixed 2.10.0+dfsg1-1ubuntu0.2 released
mantic	Fixed 2.10.0+dfsg1-1.1ubuntu1 released
trusty	ignored
xenial	ignored

Known Exploits!

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x

https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/

https://security.gentoo.org/glsa/202401-16