CVE-2018-1000852

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to the commit with ID 205c612820dac644d665b5bb1cdf437dc5ca01e3

Description The issue allows an RDP server to read the client's memory. This can occur when the client connects to the RDP server with the echo option. The vulnerability is located in the drdynvc process capability request function in the channels/drdynvc/client/drdynvc main.c file.

Recommendations To resolve the issue, update FreeRDP to a version after the commit with ID 205c612820dac644d665b5bb1cdf437dc5ca01e3. As a temporary workaround, consider avoiding the use of the echo option when connecting to RDP servers until a patch is available. Restrict access to the drdynvc process capability request function in the drdynvc main.c file to minimize the risk of exploitation.