Heap Out-of-Bounds Read in rdesktop

Executive Summary

rdesktop through 1.9.0 has a heap out-of-bounds read flaw in the process_plane() function within bitmap.c. This issue allows malicious RDP servers to crash client systems by sending malformed 32 bpp compressed bitmaps. Attackers exploit this by declaring a large bitmap size with a short compressed payload in bitmap update PDUs or bitmap cache orders, causing the client to read beyond allocated memory and trigger a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in rdesktop clients when processing RDP bitmap updates. Check logs for segmentation faults or heap corruption errors in rdesktop processes. Use network traffic analysis tools like Wireshark to inspect RDP bitmap update PDUs for malformed 32 bpp compressed bitmaps with mismatched geometry and payload sizes.

Useful 0 Not Useful 0

Impact Analysis

If you use rdesktop versions up to 1.9.0, a malicious RDP server could crash your client application by sending specially crafted bitmap data. This could disrupt your remote desktop sessions and potentially lead to loss of access to the system until the client is restarted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing service disruptions in systems handling sensitive data. Downtime from crashes may lead to violations of availability requirements in GDPR or HIPAA, especially if the affected systems are used for processing or accessing protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update rdesktop to the latest version beyond 1.9.0 to patch the heap out-of-bounds read vulnerability in process_plane(). Avoid connecting to untrusted RDP servers until patched.

Useful 0 Not Useful 0