libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected by multiple vulnerabilities:

  - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11521)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
    (CVE-2020-11523)

  - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11524)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been     detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. (CVE-2020-13398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected by multiple vulnerabilities:

  - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11521)

  - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11524)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
    (CVE-2020-11523)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2334 advisory.

  - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

  - freerdp: Integer overflow in region.c (CVE-2020-11523)

  - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for freerdp fixes the following issues :

frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006) :

  - CVE-2020-11017: Fixed a double free which could have     denied the server's service.

  - CVE-2020-11018: Fixed an out of bounds read which a     malicious clients could have triggered.

  - CVE-2020-11019: Fixed an issue which could have led to     denial of service if logger was set to 'WLOG_TRACE'.

  - CVE-2020-11038: Fixed a buffer overflow when /video     redirection was used.

  - CVE-2020-11039: Fixed an issue which could have allowed     arbitrary memory read and write when USB redirection was     enabled.

  - CVE-2020-11040: Fixed an out of bounds data read in     clear_decompress_subcode_rlex.

  - CVE-2020-11041: Fixed an issue with the configuration     for sound backend which could have led to server's     denial of service.

  - CVE-2020-11043: Fixed an out of bounds read in     rfx_process_message_tileset.

  - CVE-2020-11085: Fixed an out of bounds read in     cliprdr_read_format_list.

  - CVE-2020-11086: Fixed an out of bounds read in     ntlm_read_ntlm_v2_client_challenge.

  - CVE-2020-11087: Fixed an out of bounds read in     ntlm_read_AuthenticateMessage.

  - CVE-2020-11088: Fixed an out of bounds read in     ntlm_read_NegotiateMessage.

  - CVE-2020-11089: Fixed an out of bounds read in irp     function family.

  - CVE-2020-11095: Fixed a global out of bounds read in     update_recv_primary_order.

  - CVE-2020-11096: Fixed a global out of bounds read in     update_read_cache_bitmap_v3_order.

  - CVE-2020-11097: Fixed an out of bounds read in     ntlm_av_pair_get.

  - CVE-2020-11098: Fixed an out of bounds read in     glyph_cache_put.

  - CVE-2020-11099: Fixed an out of bounds Read in     license_read_new_or_upgrade_license_packet.

  - CVE-2020-11521: Fixed an out of bounds write in planar.c     (bsc#1171443).

  - CVE-2020-11522: Fixed an out of bounds read in gdi.c     (bsc#1171444).

  - CVE-2020-11523: Fixed an integer overflow in region.c     (bsc#1171445).

  - CVE-2020-11524: Fixed an out of bounds write in     interleaved.c (bsc#1171446).

  - CVE-2020-11525: Fixed an out of bounds read in bitmap.c     (bsc#1171447).

  - CVE-2020-11526: Fixed an out of bounds read in     update_recv_secondary_order (bsc#1171674).

  - CVE-2020-13396: Fixed an Read in     ntlm_read_ChallengeMessage.

  - CVE-2020-13397: Fixed an out of bounds read in     security_fips_decrypt due to uninitialized value.

  - CVE-2020-13398: Fixed an out of bounds write in     crypto_rsa_common.

  - CVE-2020-4030: Fixed an out of bounds read in     `TrioParse`.

  - CVE-2020-4031: Fixed a use after free in     gdi_SelectObject.

  - CVE-2020-4032: Fixed an integer casting in     `update_recv_secondary_order`.

  - CVE-2020-4033: Fixed an out of bound read in     RLEDECOMPRESS.

  - Fixed an issue where freerdp failed with -fno-common     (bsc#1169748).

  - Fixed an issue where USB redirection with FreeRDP was     not working (bsc#1169679).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2336 advisory.

    - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837632)
    - CVE-2020-11523: Fix integer overflow in region.c (#1837633)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2334 advisory.

    - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
    - CVE-2020-11523: Fix integer overflow in region.c (#1837622)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2354 advisory.

  - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

  - freerdp: Integer overflow in region.c (CVE-2020-11523)

  - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4379-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use     this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly exeucte arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - freerdp: Out-of-bounds write in planar.c     (CVE-2020-11521)

  - freerdp: Integer overflow in region.c (CVE-2020-11523)

  - freerdp: Out-of-bounds write in interleaved.c     (CVE-2020-11524)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2334 advisory.

  - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11521)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
    (CVE-2020-11523)

  - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2336 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

    * freerdp: Integer overflow in region.c (CVE-2020-11523)

    * freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2335 advisory.

  - freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

  - freerdp: Integer overflow in region.c (CVE-2020-11523)

  - freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202005-07 (FreeRDP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeRDP. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
154493	NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0143)	Nessus	NewStart CGSL Local Security Checks	high
143957	NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Multiple Vulnerabilities (NS-SA-2020-0076)	Nessus	NewStart CGSL Local Security Checks	medium
139384	RHEL 7 : freerdp (RHSA-2020:2334)	Nessus	Red Hat Local Security Checks	medium
139018	openSUSE Security Update : freerdp (openSUSE-2020-1090)	Nessus	SuSE Local Security Checks	high
137249	FreeBSD : FreeRDP -- multiple vulnerabilities (669f3fe8-a07a-11ea-b83e-f0def1f5c5a2)	Nessus	FreeBSD Local Security Checks	medium
137218	Oracle Linux 8 : freerdp (ELSA-2020-2336)	Nessus	Oracle Linux Local Security Checks	medium
137171	Oracle Linux 7 : freerdp (ELSA-2020-2334)	Nessus	Oracle Linux Local Security Checks	medium
137059	RHEL 8 : freerdp (RHSA-2020:2354)	Nessus	Red Hat Local Security Checks	medium
137045	Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4379-1)	Nessus	Ubuntu Local Security Checks	high
137040	Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200528)	Nessus	Scientific Linux Local Security Checks	medium
137005	CentOS 7 : freerdp (RHSA-2020:2334)	Nessus	CentOS Local Security Checks	medium
136975	RHEL 8 : freerdp (RHSA-2020:2336)	Nessus	Red Hat Local Security Checks	medium
136974	RHEL 8 : freerdp (RHSA-2020:2335)	Nessus	Red Hat Local Security Checks	medium
136637	GLSA-202005-07 : FreeRDP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2020-11524

medium

Tenable Plugins

high

medium

medium

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium