Bug 1854899 (CVE-2020-11099) - CVE-2020-11099 freerdp: out of bounds read in license_read_new_or_upgrade_license_packet
Summary: CVE-2020-11099 freerdp: out of bounds read in license_read_new_or_upgrade_lic...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-11099
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1854900 1854901 1855528 1855529
Blocks: 1854906
TreeView+ depends on / blocked
 
Reported: 2020-07-08 12:25 UTC by Dhananjay Arunesh
Modified: 2022-11-29 06:06 UTC (History)
4 users (show)

Fixed In Version: freerdp 2.1.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 20:34:18 UTC
Embargoed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-07-08 12:25:16 UTC
In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.

References:
http://www.freerdp.com/2020/06/22/2_1_2-released
https://github.com/FreeRDP/FreeRDP/commit/6ade7b4cbfd71c54b3d724e8f2d6ac76a58e879a
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-977w-866x-4v5h

Comment 1 Dhananjay Arunesh 2020-07-08 12:27:08 UTC
Created freerdp tracking bugs for this issue:

Affects: epel-all [bug 1854901]
Affects: fedora-all [bug 1854900]

Comment 2 Todd Cullum 2020-07-10 05:10:11 UTC
Technical Summary:

In the freerdp CLIENT, license_read_new_or_upgrade_license_packet() in libfreerdp/core/license.c reads from the licenseStream buffer multiple times without first ensuring that there are enough bytes left in the buffer. Thus, it's possible for the routine to read past the end of the licenseStream buffer by at most 20 bytes + cbCompanyName. The upstream patch uses Stream_GetRemainingLength() to prevent this. The license stream data is obtained from the server, thus exploitation of this flaw would require the client to connect to a malicious or compromised server.

Comment 4 errata-xmlrpc 2021-05-18 15:34:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1849 https://access.redhat.com/errata/RHSA-2021:1849

Comment 5 Product Security DevOps Team 2021-05-18 20:34:18 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11099


Note You need to log in before you can comment on or make changes to this bug.