Cybersecurity specialists report the detection of two severe vulnerabilities in the popular FreeRDP programming language. According to the report, successful exploitation of these flaws would allow threat actors to seriously compromise affected systems.
Below are brief descriptions of the reported flaws, in addition to their respective tracking keys and scores assigned under the Common Vulnerability Scoring System (CVSS).
CVE-2021-41159: A boundary error when processing /gt:rpc connections would allow threat actors to send specially crafted data to the client from a remote server, leading to arbitrary code execution on the target system.
This is a high severity flaw and received a CVSS score of 7,710, as its successful exploitation would put the entire affected system at risk.
CVE-2021-41160: A boundary error when processing connections with GDI or SurfaceCommands would allow a remote server to send specially crafted data to the client, trigger an out-of-bounds write, and execute arbitrary code.
The flaw received a CVSS score of 7.7/10 and its successful exploitation would allow threat actors to take full control of the compromised system.
According to the report, these flaws reside in the following Versions of FreeRDP: 2.0.0, 2.0.0 rc0, 2.0.0 rc1, 2.0.0 rc2, 2.0.0 rc3, 2.0.0 rc4, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.3.0, 2.3.1, 2.3.2 and 2.4.0.
Although both flaws can be exploited by unauthenticated remote attackers over the Internet, so far no active exploitation attempts or the presence of a malware variant associated with the attack have been detected. On the other hand, security patches are already supported, so users of exposed versions are recommended to update as soon as possible.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
