Out-of-Bounds Read Vulnerability in FreeRDP Affected by NTLM Implementation
CVE-2020-13396

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
22 May 2020

What is CVE-2020-13396?

An out-of-bounds read vulnerability in FreeRDP prior to version 2.1.1 affects the processing of NTLM challenge messages. The issue arises from improper handling in the 'ntlm_read_ChallengeMessage' function in winpr/libwinpr/sspi/NTLM/ntlm_message.c, potentially allowing attackers to read sensitive information from memory. This flaw highlights the importance of timely updates to mitigate security risks.

References

https://github.com/FreeRDP/FreeRDP/compare/2.1.0...2.1.1
https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abc...
https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.