Server side NTLM does not properly check parameters in FreeRDP
Summary
Server side NTLM does not properly check parameters in FreeRDP
Original description
The description as published by the source.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-24882 freerdp2 Fixed in: 2.3.0+dfsg1-2+deb11u3
References
- advisory github.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- patch github.com
- report gitlab.gnome.org
- web github.com
- web lists.debian.org