Impact
A malicious server might trigger out of bound writes in a connected client.
Connections using GDI or SurfaceCommands to send graphics updates to the client might send 0 width/height or out of bound rectangles to trigger out of bound writes.
With 0 width or heigth the memory allocation will be 0 but the missing bounds checks allow writing to the pointer at this (not allocated) region.
Patches
FreeRDP 2.4.1
Reported by Sunglin from the Knownsec 404 team & 0103 sec team
For more information
If you have any questions or comments about this advisory:
Impact
A malicious server might trigger out of bound writes in a connected client.
Connections using GDI or SurfaceCommands to send graphics updates to the client might send
0width/height or out of bound rectangles to trigger out of bound writes.With
0width or heigth the memory allocation will be0but the missing bounds checks allow writing to the pointer at this (not allocated) region.Patches
FreeRDP 2.4.1
Reported by
Sunglin from the Knownsec 404 team & 0103 sec teamFor more information
If you have any questions or comments about this advisory: