Heap Buffer Overflow in FreeRDP

Executive Summary

This vulnerability is a heap buffer overflow in FreeRDP versions before 3.32.2. It occurs in the transport_default_read_pdu function when processing partial Early User Authorization (EUA) reads during PROTOCOL_HYBRID_EX CredSSP operations. A malicious RDP server can split the four-byte EUA result into short reads, advancing the stream pointer beyond the 16 KiB allocated buffer. This leads to an out-of-bounds write, causing client denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system using commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' for Debian-based systems. Compare the version against 3.32.2 or later. Monitor network traffic for RDP connections using tools like Wireshark to identify potential malicious servers attempting CredSSP handshakes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause denial of service for the FreeRDP client. A malicious RDP server could exploit this to crash the client application. While confidentiality loss or reliable code execution was not demonstrated, heap corruption could potentially allow attacker-controlled data to overwrite memory in assert-free builds.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.2 or later. If updating is not possible, disable RDP connections to untrusted servers or use a firewall to restrict RDP traffic. Ensure CredSSP is configured securely and avoid connecting to suspicious RDP servers until patched.

Useful 0 Not Useful 0