CVE-2014-0791: Integer Overflow
Integer overflow in the licensereadscopelist function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Other sources
This is from libfreerdp-core/licensereadscopelist():
streamreaduint32(s, scopeCount); / ScopeCount (4 bytes) /
scopeList->count = scopeCount; scopeList->array = (LICENSEBLOB) xmalloc(sizeof(LICENSEBLOB) scopeCount);
Assuming that scopeCount is read from the wire, this results in an integer overflow in the size computation. The array is subsequentially filled with pointers and constants, so this is probably not exploitable for anything but a crash:
/ ScopeArray / for (i = 0; i < scopeCount; i++) { scopeList->array[i].type = BBSCOPEBLOB; licensereadbinaryblob(s, &scopeList->array[i]); }
But I'm filing it as an embargoed security bug just to be sure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0791?
The severity of CVE-2014-0791 is considered to be moderate due to the potential denial of service caused by the integer overflow.
What versions of FreeRDP are affected by CVE-2014-0791?
CVE-2014-0791 affects FreeRDP versions 1.0.0, 1.0.1, and 1.0.2.
How do I fix CVE-2014-0791?
To fix CVE-2014-0791, update FreeRDP to a version later than 1.0.2 where the vulnerability has been addressed.
What type of vulnerability is CVE-2014-0791?
CVE-2014-0791 is an integer overflow vulnerability that can lead to denial of service.
Can CVE-2014-0791 be exploited remotely?
Yes, CVE-2014-0791 can be exploited remotely through specially crafted requests sent to the RDP server.