Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE for freerdp int overflow?
From: cve-assign () mitre org
Date: Fri, 3 Jan 2014 12:02:56 -0500 (EST)

Hash: SHA1

This is from libfreerdp-core/license_read_scope_list():

From: Huzaifa Sidhpurwala 

No CVE has been assigned yet. The crash seems to be non-exploitable and
I am not really sure if only the client and/or server are affected.

The function in question is in the client code for the Remote Desktop
Protocol Licensing Extension described on the
http://msdn.microsoft.com/en-us/library/cc241880.aspx web page. The
code is part of the reading of a Server License Request packet. The
integer overflow affects a malloc argument. After this, the client
would normally make separate malloc calls and write (a potentially
very large amount of) data from the server into that separately
malloced memory. Effects depend on the malloc implementation and the
architecture. Even if code execution were essentially impossible,
other conceivable security impacts exist. For example, the client
might later send unintended private information (license data for a
different server?) over the connection to the current server.

says "Multiple sessions ... Yes" but we don't know whether that refers
to FreeRDP 1.x or FreeRDP 0.x (which is a different codebase and
allowed the user to start multiple sessions with a single command as
described in the
http://sourceforge.net/mailarchive/message.php?msg_id=24558104 post).
If one server can send a crafted Server License Request packet that
causes memory corruption and leads to a crash of multiple sessions, a
CVE ID can be assigned. (The crash could perhaps not happen
immediately, and instead happen after the user established important
state in a session to a non-malicious server.)

Even without that, a CVE ID seems probably worthwhile for the largely
unpredictable client behavior after the erroneous malloc call.

Use CVE-2014-0791.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
Version: GnuPG v1.4.14 (SunOS)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]