Bug 857491 (CVE-2014-0791)

Summary: VUL-0: CVE-2014-0791: freerdp: integer overflow
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Felix Zhang <fezhang>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: abergmann, jsegitz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2014-01-06 08:42:29 UTC
OSS:11786

The function in question is in the client code for the Remote Desktop
Protocol Licensing Extension described on the
http://msdn.microsoft.com/en-us/library/cc241880.aspx web page. The
code is part of the reading of a Server License Request packet. The
integer overflow affects a malloc argument. After this, the client
would normally make separate malloc calls and write (a potentially
very large amount of) data from the server into that separately
malloced memory. Effects depend on the malloc implementation and the
architecture. Even if code execution were essentially impossible,
other conceivable security impacts exist. For example, the client
might later send unintended private information (license data for a
different server?) over the connection to the current server.

http://en.wikipedia.org/wiki/Comparison_of_remote_desktop_software
says "Multiple sessions ... Yes" but we don't know whether that refers
to FreeRDP 1.x or FreeRDP 0.x (which is a different codebase and
allowed the user to start multiple sessions with a single command as
described in the
http://sourceforge.net/mailarchive/message.php?msg_id=24558104 post).
If one server can send a crafted Server License Request packet that
causes memory corruption and leads to a crash of multiple sessions, a
CVE ID can be assigned. (The crash could perhaps not happen
immediately, and instead happen after the user established important
state in a session to a non-malicious server.)

Even without that, a CVE ID seems probably worthwhile for the largely
unpredictable client behavior after the erroneous malloc call.

Use CVE-2014-0791.


References:
https://bugzilla.redhat.com/show_bug.cgi?id=998941
http://comments.gmane.org/gmane.comp.security.oss.general/11786
Comment 1 Swamp Workflow Management 2014-01-06 23:00:25 UTC
bugbot adjusting priority
Comment 2 Lance Wang 2014-01-07 03:32:57 UTC
Hi David

Assign it to you.
Comment 4 Alexander Bergmann 2014-04-15 08:28:34 UTC
It looks like version 0.8.2 is not affected by this. Felix, could you please verify.
Comment 6 Thomas Biege 2014-06-22 10:42:07 UTC
Felix, can you have a look at this please. Thank you.
Comment 12 Felix Zhang 2014-06-24 03:52:49 UTC
Fix checked in SUSE:SLE-12:GA.
Comment 13 Bernhard Wiedemann 2014-06-24 12:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (857491) was mentioned in
https://build.opensuse.org/request/show/238487 12.3 / freerdp
https://build.opensuse.org/request/show/238488 13.1 / freerdp
Comment 14 Felix Zhang 2014-06-25 06:26:05 UTC
Fix checked in X11:RemoteDesktop and openSUSE:Factory.
Mark this as fixed.
Comment 15 Swamp Workflow Management 2014-07-01 12:04:25 UTC
openSUSE-SU-2014:0862-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 857491,880317
CVE References: CVE-2014-0250,CVE-2014-0791
Sources used:
openSUSE 13.1 (src):    freerdp-1.0.2-3.4.1
openSUSE 12.3 (src):    freerdp-1.0.2-11.12.1
Comment 18 Swamp Workflow Management 2016-09-27 19:10:38 UTC
openSUSE-SU-2016:2400-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 829013,857491
CVE References: CVE-2013-4118,CVE-2014-0791
Sources used:
openSUSE 13.2 (src):    freerdp-1.0.2-8.3.1
Comment 19 Swamp Workflow Management 2016-09-27 19:11:25 UTC
openSUSE-SU-2016:2402-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 829013,857491
CVE References: CVE-2013-4118,CVE-2014-0791
Sources used:
openSUSE Leap 42.1 (src):    freerdp-1.0.2-11.1
Comment 20 Swamp Workflow Management 2016-10-12 13:10:31 UTC
SUSE-SU-2016:2506-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 829013,857491,880317
CVE References: CVE-2013-4118,CVE-2014-0250,CVE-2014-0791
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    freerdp-1.0.2-9.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    freerdp-1.0.2-9.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    freerdp-1.0.2-9.1