Impact
- All FreeRDP clients, all platforms
When using /video redirection a manipulated server can instruct the client to allocate a buffer which is allocated with a smaller size than requested due to an integer overflow in size calculation.
With later messages the server can manipulate the client to write data out of bound to the previously allocated buffer.
Workarounds
Deactivate VIDEO redirection client side, don´ t use /video
References
Impact
When using
/videoredirection a manipulated server can instruct the client to allocate a buffer which is allocated with a smaller size than requested due to an integer overflow in size calculation.With later messages the server can manipulate the client to write data out of bound to the previously allocated buffer.
Workarounds
Deactivate VIDEO redirection client side, don´ t use
/videoReferences