[ASA-202005-16] freerdp: information disclosure

[Morten Linderud]

Arch Linux Security Advisory ASA-202005-16
==========================================

Severity: High
Date    : 2020-05-23
CVE-ID  : CVE-2020-13396 CVE-2020-13397 CVE-2020-13398
Package : freerdp
Type    : information disclosure
Remote  : No
Link    : https://security.archlinux.org/AVG-1172

Summary
=======

The package freerdp before version 2:2.1.1-1 is vulnerable to
information disclosure.

Resolution
==========

Upgrade to 2:2.1.1-1.

# pacman -Syu "freerdp>=2:2.1.1-1"

The problems have been fixed upstream in version 2.1.1.

Workaround
==========

None.

Description
===========

- CVE-2020-13396 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
read vulnerability has been detected in ntlm_read_ChallengeMessage in
winpr/libwinpr/sspi/NTLM/ntlm_message.c.

- CVE-2020-13397 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
read vulnerability has been detected in security_fips_decrypt in
libfreerdp/core/security.c due to an uninitialized value.

- CVE-2020-13398 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
write vulnerability has been detected in crypto_rsa_common in
libfreerdp/crypto/crypto.c.

Impact
======

A local malicious user can send crafted network traffic and leak
information from the host.

References
==========

https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20e1da6bc
https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69
https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8
https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc607655aadea
https://security.archlinux.org/CVE-2020-13396
https://security.archlinux.org/CVE-2020-13397
https://security.archlinux.org/CVE-2020-13398
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200601/26c65029/attachment.sig>