Описание
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send a Universal Serial Bus (USB) Redirection for Remote Desktop Connection (URBDRC) control-transfer request with an invalid OutputBufferSize. This can trigger an assertion in the client process, leading to a denial of service where the client application terminates unexpectedly.
Меры по смягчению последствий
To mitigate this issue, users should only connect to trusted RDP servers. Additionally, running the FreeRDP client within a sandboxed environment can help limit the potential impact of such vulnerabilities.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | freerdp | Affected | ||
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 7 | freerdp | Affected | ||
| Red Hat Enterprise Linux 8 | freerdp | Affected | ||
| Red Hat Enterprise Linux 9 | freerdp | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
[GHSA-w9qg-g24r-77f6: URBDRC/libusb control-transfer path aborts on reachable OutputBufferSize assertion]
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in th ...
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.
EPSS
6.5 Medium
CVSS3