Arch Linux Security Advisory ASA-202005-16

Severity: High
Date : 2020-05-23
CVE-ID : CVE-2020-13396 CVE-2020-13397 CVE-2020-13398
Package : freerdp
Type : information disclosure
Remote : No
Link : https://security.archlinux.org/AVG-1172

Summary

The package freerdp before version 2:2.1.1-1 is vulnerable to
information disclosure.

Resolution

Upgrade to 2:2.1.1-1.

pacman -Syu “freerdp>=2:2.1.1-1”

The problems have been fixed upstream in version 2.1.1.

Workaround

None.

Description

• CVE-2020-13396 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
read vulnerability has been detected in ntlm_read_ChallengeMessage in
winpr/libwinpr/sspi/NTLM/ntlm_message.c.

• CVE-2020-13397 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
read vulnerability has been detected in security_fips_decrypt in
libfreerdp/core/security.c due to an uninitialized value.

• CVE-2020-13398 (information disclosure)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB)
write vulnerability has been detected in crypto_rsa_common in
libfreerdp/crypto/crypto.c.

Impact

A local malicious user can send crafted network traffic and leak
information from the host.

References

https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20e1da6bc
https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69
https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8
https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc607655aadea
https://security.archlinux.org/CVE-2020-13396
https://security.archlinux.org/CVE-2020-13397
https://security.archlinux.org/CVE-2020-13398