Heap Out-of-Bounds Read in FreeRDP Windows Client

Executive Summary

FreeRDP versions from 3.30.0 to 3.32.0 have a heap out-of-bounds read flaw in the Windows client's CliprdrStream_New function. Malicious RDP servers can exploit this by sending short clipboard responses, specifically answering a FILECONTENTS_SIZE request with fewer than eight bytes when a user pastes a remote file. This causes the client to crash or corrupt the stream size.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. If it is between 3.30.0 and 3.31.99, it is vulnerable. Use commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers controlling an RDP server to crash the FreeRDP client or corrupt memory when a user pastes a remote file. This could lead to denial-of-service conditions or potential data corruption during clipboard operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves a heap out-of-bounds read in FreeRDP's Windows client, requiring user interaction to trigger. No evidence suggests it leads to unauthorized data access, disclosure, or system compromise that would violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update FreeRDP to version 3.32.0 or later to address the heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New.

Useful 0 Not Useful 0