Summary
It was discovered that FreeRDP incorrectly handled empty password values. A
remote attacker could use this issue to bypass server authentication. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10.
(CVE-2022-24882)
It was discovered that FreeRDP incorrectly handled server configurations
with an invalid SAM file path. A remote attacker could use this issue to
bypass server authentication. (CVE-2022-24883)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | freerdp2 | 2.2.0+dfsg1-0ubuntu0.18.04.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | freerdp2 | 2.2.0+dfsg1-0ubuntu0.20.04.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | freerdp2 | 2.6.1+dfsg1-3ubuntu2.1 |
Vulnerabilities 2
-
Critical 9.1
Server side NTLM does not properly check parameters in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server impleme…
-
High 7.4
FreeRDP Server authentication might allow invalid credentials to pass
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based c…