Heap-based Out-of-Bounds Write in FreeRDP

Executive Summary

This vulnerability is a heap-based out-of-bounds write in FreeRDP versions 3.3.0 to 3.32.0 when built with WINPR_UTILS_IMAGE_JPEG=ON. It occurs because grayscale JPEG buffers are sized incorrectly, using one input component instead of three BGR output components. A malicious RDP server can exploit this by offering a grayscale JPEG via clipboard redirection, which corrupts client memory and crashes the application when pasted as CF_DIB bitmap data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the FreeRDP version on your system. If you are running FreeRDP 3.3.0 before 3.32.0 and it was built with WINPR_UTILS_IMAGE_JPEG=ON, you are likely vulnerable. Use the command 'xfreerdp --version' or 'apt show freerdp2-x11' (for Debian-based systems) to check the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP with the affected configuration, a malicious RDP server could crash your client application by exploiting this vulnerability. This could lead to denial-of-service conditions or potential memory corruption, though it requires user interaction such as pasting clipboard data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to memory corruption in FreeRDP's clipboard handling. However, if exploited, it could lead to denial-of-service or potential unauthorized access, which may indirectly impact compliance by disrupting data integrity or availability.

Useful 0 Not Useful 0

Mitigation Strategies

Update FreeRDP to version 3.32.0 or later to address the heap-based out-of-bounds write vulnerability. Disable clipboard redirection if not needed or restrict it to trusted sources.

Useful 0 Not Useful 0