Bug 1854899 (CVE-2020-11099)

Summary:	CVE-2020-11099 freerdp: out of bounds read in license_read_new_or_upgrade_license_packet
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mads, negativo17, oholy, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	freerdp 2.1.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:34:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1854900, 1854901, 1855528, 1855529
Bug Blocks:	1854906

Description Dhananjay Arunesh 2020-07-08 12:25:16 UTC

In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.

References:
http://www.freerdp.com/2020/06/22/2_1_2-released
https://github.com/FreeRDP/FreeRDP/commit/6ade7b4cbfd71c54b3d724e8f2d6ac76a58e879a
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-977w-866x-4v5h

Comment 1 Dhananjay Arunesh 2020-07-08 12:27:08 UTC

Created freerdp tracking bugs for this issue:

Affects: epel-all [bug 1854901]
Affects: fedora-all [bug 1854900]

Comment 2 Todd Cullum 2020-07-10 05:10:11 UTC

Technical Summary:

In the freerdp CLIENT, license_read_new_or_upgrade_license_packet() in libfreerdp/core/license.c reads from the licenseStream buffer multiple times without first ensuring that there are enough bytes left in the buffer. Thus, it's possible for the routine to read past the end of the licenseStream buffer by at most 20 bytes + cbCompanyName. The upstream patch uses Stream_GetRemainingLength() to prevent this. The license stream data is obtained from the server, thus exploitation of this flaw would require the client to connect to a malicious or compromised server.

Comment 4 errata-xmlrpc 2021-05-18 15:34:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1849 https://access.redhat.com/errata/RHSA-2021:1849

Comment 5 Product Security DevOps Team 2021-05-18 20:34:18 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11099