Impact

Server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path

• FreeRDP based clients are not affected.
• RDP server implementations using FreeRDP to authenticate against a SAM file are affected

Patches

• Release 2.7.0
• Commit 4661492 (Backport 6f473b2)

Workarounds

• Use custom authentication via HashCallback
• Ensure the SAM database path configured is valid and the application has file handles left

References

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/FreeRDP/FreeRDP
• See https://www.freerdp.com/ for contact details
• Email us at security@freerdp.com