VDB
CNVD-2021-103653
CNVD-2021-103653
PUBLISHED
FreeRDP是Freerdp团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP在2.4.1之前版本存在缓冲区错误漏洞，该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞通过恶意服务器可能会在连接的客户端中触发越界写入导致远程代码执行。
Exploit Intelligence
- FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of CVE project by @Sn0wAlice (github-poc-repo)
- FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of CVE project by @Sn0wAlice (github-poc-repo)
- FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of CVE project by @Sn0wAlice (github-poc)
- FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of CVE project by @Sn0wAlice (github-poc)
Timeline
- Oct 21, 2021 CVE Published