Buffer Over-Read in FreeRDP RPC Gateway Transport Parser

Executive Summary

FreeRDP before version 3.31.0 has a buffer over-read flaw in the rts_read_result function. This function checks only 2 bytes of a result structure but reads 4 bytes, causing an out-of-bounds read when a malicious BIND_ACK packet with a truncated result entry is received. This leads to a process abort due to an assertion failure, resulting in a denial-of-service condition.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP versions and network traffic for malformed BIND_ACK packets. Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Inspect RPC-over-HTTP traffic for truncated BIND_ACK PDUs using Wireshark filters like 'tcp.port==3389 && rpcbind && rts'.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions before 3.31.0 and connect through a compromised RD Gateway, an attacker could send a specially crafted packet to crash your FreeRDP client. This would disrupt your remote desktop session and could lead to denial of service. The attack requires a phishing-style compromise of the gateway rather than direct remote exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that affect data availability. For GDPR, availability is a key principle, so repeated DoS conditions might indicate inadequate security measures. For HIPAA, service interruptions could disrupt access to protected health information, potentially violating access controls. However, direct compliance violations depend on specific organizational contexts and mitigations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.31.0 or later. If updating is not possible, disable RD Gateway connections or restrict access to trusted gateways only. Monitor network traffic for suspicious RPC-over-HTTP packets.

Useful 0 Not Useful 0