PT-2020-13518 · Freerdp+8 · Freerdp+8

Published 2020-05-20 · Updated 2024-06-15 · CVE-2020-13396

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.1.1

Description An out-of-bounds read issue has been detected in the ntlm read ChallengeMessage function in winpr/libwinpr/sspi/NTLM/ntlm message.c. This issue affects FreeRDP.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ntlm read ChallengeMessage function until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2020:4647

ALT-PU-2020-1985

ALT-PU-2020-2000

CESA-2020_4031

CESA-2020_4647

CVE-2020-13396

DLA-2356-1

DLA-3606-1

MGASA-2020-0297

OPENSUSE-SU-2020:1090-1

OPENSUSE-SU-2020_1090-1

OPENSUSE-SU-2024:10768-1

RHSA-2020:4031

RHSA-2020:4647

RHSA-2020_4031

RHSA-2020_4647

RLSA-2020:4647

SUSE-SU-2020:2032-1

SUSE-SU-2020:2068-1

SUSE-SU-2020:2272-1

USN-4379-1

USN-4382-1

USN-4382-2

Affected Products

Alt Linux

Almalinux

Centos

Freerdp

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 237

• https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20e1da6bc · Patch
• https://osv.dev/vulnerability/SUSE-SU-2020:2032-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4647.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11521 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0297 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2272-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17177 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13396 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4647 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13396 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000852 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4382-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13396 · Security Note
• https://osv.dev/vulnerability/DLA-3606-1 · Vendor Advisory