PT-2018-3040 · Freerdp+5 · Freerdp+5
Eyal Itkin
·
Publicado
2016-04-08
·
Atualizado
2024-06-15
·
CVE-2018-8787
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 2.0.0-rc4
Description
The issue is caused by an Integer Overflow in the
gdi Bitmap Decompress() function, leading to a Heap-Based Buffer Overflow. This results in memory corruption and potentially allows for remote code execution. The vulnerability can be exploited by a remote attacker to cause a denial of service or execute arbitrary code.Recommendations
For versions prior to 2.0.0-rc4, consider updating to version 2.0.0-rc4 or later to resolve the issue. As a temporary workaround, consider disabling the
gdi Bitmap Decompress() function until a patch is available. Restrict access to the RDP client to minimize the risk of exploitation.Exploit
Correção
RCE
Integer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Freerdp
Red Hat
Suse
Ubuntu