GHSA-3hf9-w6hr-hf9j: FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpduwriteheader assertion that crashes the process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients are exposed when they connect to a malicious server that sends an oversized LoadBalanceInfo in a Server Redirection PDU. A FixedTarget freerdp-proxy is exposed to unauthenticated peers that can send a 240–247 byte routing token.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required. An attacker needs to be able to act as a malicious server for a client connection, or to send the specified token to an affected FixedTarget freerdp-proxy.