Date: Fri, 3 Jan 2014 12:02:56 -0500 (EST) From: cve-assign@...re.org To: geissert@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, huzaifas@...hat.com Subject: Re: CVE for freerdp int overflow? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://bugzilla.redhat.com/show_bug.cgi?id=998941 > This is from libfreerdp-core/license_read_scope_list(): > From: Huzaifa Sidhpurwala > No CVE has been assigned yet. The crash seems to be non-exploitable and > I am not really sure if only the client and/or server are affected. The function in question is in the client code for the Remote Desktop Protocol Licensing Extension described on the http://msdn.microsoft.com/en-us/library/cc241880.aspx web page. The code is part of the reading of a Server License Request packet. The integer overflow affects a malloc argument. After this, the client would normally make separate malloc calls and write (a potentially very large amount of) data from the server into that separately malloced memory. Effects depend on the malloc implementation and the architecture. Even if code execution were essentially impossible, other conceivable security impacts exist. For example, the client might later send unintended private information (license data for a different server?) over the connection to the current server. http://en.wikipedia.org/wiki/Comparison_of_remote_desktop_software says "Multiple sessions ... Yes" but we don't know whether that refers to FreeRDP 1.x or FreeRDP 0.x (which is a different codebase and allowed the user to start multiple sessions with a single command as described in the http://sourceforge.net/mailarchive/message.php?msg_id=24558104 post). If one server can send a crafted Server License Request packet that causes memory corruption and leads to a crash of multiple sessions, a CVE ID can be assigned. (The crash could perhaps not happen immediately, and instead happen after the user established important state in a session to a non-malicious server.) Even without that, a CVE ID seems probably worthwhile for the largely unpredictable client behavior after the erroneous malloc call. Use CVE-2014-0791. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSxu0XAAoJEKllVAevmvms6hQH/Rgejpz5x4evfagXceQAx/61 pNWtFgeWt/DG6OT+yoggf5F/skn80FduXZ8IYP47ssBP6gDgyGnPsaq5/eYjyL9G R5ruNaw5Zeq1GCoyHJEXyK7FZtCME2wvsGjwyZ60EZg/wLiEhU3EX8at+6s8h6Ya wHI60o7oqB01xenPe/huGb5RbtBPZ5L7dhe8euHF1JO7UijPwsY6+mO+x/R/Eef0 09TNi9h9sJOinGXR9yh2a0Lt6sXYfJRY2R3nqC2tlN/frjsV9OQ7fNuKtCBmMRgk 8ewuZYy+hLIenNDS89UHOzjTMT+8EtfDRycLP73JXNEQC7+0FBTvp/H4HziLGd4= =8WuC -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ