CVE-2020-11097

LOW

FreeRDP < 2.1.2 - Out-of-bounds Read in PRIMARY_DRAWING_ORDER_FIELD_BYTES

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-11097. PoCs published by SpiralBL0CK.

AI-analyzed exploit summary This PoC exploits CVE-2020-11097, an out-of-bounds read vulnerability in FreeRDP's NTLM authentication. It crafts a malicious NTLM Type 2 message with an oversized AV pair length to trigger a crash during authentication.

Description

In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

Exploits (1)

nomisec WORKING POC

by SpiralBL0CK · poc

https://github.com/SpiralBL0CK/CVE-2020-11097-POC

View Code ZIP pw:eip

This PoC exploits CVE-2020-11097, an out-of-bounds read vulnerability in FreeRDP's NTLM authentication. It crafts a malicious NTLM Type 2 message with an oversized AV pair length to trigger a crash during authentication.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: FreeRDP (versions before 2.1.2)

No auth needed

Prerequisites: Network access to target RDP service · FreeRDP client configured to connect to the malicious server

MITRE ATT&CK