CVE-2020-13396: 
NixOS vulnerability analysis and mitigation

An out-of-bounds (OOB) read vulnerability was discovered in FreeRDP before version 2.1.1, specifically in the ntlm_read_ChallengeMessage function within winpr/libwinpr/sspi/NTLM/ntlm_message.c. The vulnerability was identified on May 22, 2020 (MITRE, GitHub Lab).

The vulnerability occurs due to a memcpy operation with an attacker-controlled size in the ntlm_read_ChallengeMessage function. The length parameter is calculated as the addition of TargetName.Len and TargetInfo.Len, both values being controlled by remote input. There is no validation to ensure that the length value does not exceed the buffer's size, which can lead to out-of-bounds memory access (GitHub Lab).

The vulnerability could allow an attacker to perform out-of-bounds reads, potentially leading to information disclosure or denial of service. The CVSS 3 severity score is rated as 7.1 (High), with network attack vector, low attack complexity, low privileges required, and no user interaction needed (Ubuntu).

The vulnerability requires a malicious actor to control the input values for TargetName.Len and TargetInfo.Len in the NTLM challenge message. The attack can be executed remotely with low complexity and requires low privileges (GitHub Lab).

The vulnerability was fixed in FreeRDP version 2.1.1. The fix includes proper length validation before performing memory operations. Users are advised to upgrade to version 2.1.1 or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and openSUSE (Debian LTS, Ubuntu Security).