Bugzilla – Bug 857491
VUL-0: CVE-2014-0791: freerdp: integer overflow
Last modified: 2016-10-12 13:10:31 UTC
OSS:11786 The function in question is in the client code for the Remote Desktop Protocol Licensing Extension described on the http://msdn.microsoft.com/en-us/library/cc241880.aspx web page. The code is part of the reading of a Server License Request packet. The integer overflow affects a malloc argument. After this, the client would normally make separate malloc calls and write (a potentially very large amount of) data from the server into that separately malloced memory. Effects depend on the malloc implementation and the architecture. Even if code execution were essentially impossible, other conceivable security impacts exist. For example, the client might later send unintended private information (license data for a different server?) over the connection to the current server. http://en.wikipedia.org/wiki/Comparison_of_remote_desktop_software says "Multiple sessions ... Yes" but we don't know whether that refers to FreeRDP 1.x or FreeRDP 0.x (which is a different codebase and allowed the user to start multiple sessions with a single command as described in the http://sourceforge.net/mailarchive/message.php?msg_id=24558104 post). If one server can send a crafted Server License Request packet that causes memory corruption and leads to a crash of multiple sessions, a CVE ID can be assigned. (The crash could perhaps not happen immediately, and instead happen after the user established important state in a session to a non-malicious server.) Even without that, a CVE ID seems probably worthwhile for the largely unpredictable client behavior after the erroneous malloc call. Use CVE-2014-0791. References: https://bugzilla.redhat.com/show_bug.cgi?id=998941 http://comments.gmane.org/gmane.comp.security.oss.general/11786
bugbot adjusting priority
Hi David Assign it to you.
Upstream fix: https://github.com/FreeRDP/FreeRDP/commit/f1d6afca6ae620f9855a33280bdc6f3ad9153be0#diff-b6d68bbca6e0f5875c57ef225cd65c45
It looks like version 0.8.2 is not affected by this. Felix, could you please verify.
Felix, can you have a look at this please. Thank you.
Fix checked in SUSE:SLE-12:GA.
This is an autogenerated message for OBS integration: This bug (857491) was mentioned in https://build.opensuse.org/request/show/238487 12.3 / freerdp https://build.opensuse.org/request/show/238488 13.1 / freerdp
Fix checked in X11:RemoteDesktop and openSUSE:Factory. Mark this as fixed.
openSUSE-SU-2014:0862-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 857491,880317 CVE References: CVE-2014-0250,CVE-2014-0791 Sources used: openSUSE 13.1 (src): freerdp-1.0.2-3.4.1 openSUSE 12.3 (src): freerdp-1.0.2-11.12.1
openSUSE-SU-2016:2400-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 829013,857491 CVE References: CVE-2013-4118,CVE-2014-0791 Sources used: openSUSE 13.2 (src): freerdp-1.0.2-8.3.1
openSUSE-SU-2016:2402-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 829013,857491 CVE References: CVE-2013-4118,CVE-2014-0791 Sources used: openSUSE Leap 42.1 (src): freerdp-1.0.2-11.1
SUSE-SU-2016:2506-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 829013,857491,880317 CVE References: CVE-2013-4118,CVE-2014-0250,CVE-2014-0791 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP1 (src): freerdp-1.0.2-9.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): freerdp-1.0.2-9.1 SUSE Linux Enterprise Desktop 12-SP1 (src): freerdp-1.0.2-9.1