Heap Out-of-Bounds Read in rdesktop RDP Client

Executive Summary

rdesktop through version 1.9.0 has a heap out-of-bounds read flaw in the process_raw_bmpcache() function located in orders.c. This vulnerability allows malicious RDP servers to crash client applications by sending a specially crafted raw bitmap cache order with large width, height, and bits-per-pixel values but a very small payload. The memcpy() function then reads beyond the allocated receive buffer, causing a crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes in rdesktop clients or inspecting network traffic for malformed RDP bitmap cache orders. Check rdesktop logs for heap corruption errors or unexpected terminations. Use network tools like Wireshark to capture and analyze RDP traffic for unusually large width, height, or bpp values in bitmap cache orders.

Useful 0 Not Useful 0

Impact Analysis

If you use rdesktop as a client to connect to untrusted or compromised RDP servers, this vulnerability could cause your application to crash. This may lead to denial-of-service conditions, disrupting your remote desktop sessions. However, it does not appear to allow arbitrary code execution or data theft based on the provided details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing client applications, which may impact availability of systems handling sensitive data. For GDPR, availability is a key principle, so repeated crashes could affect compliance. HIPAA requires availability of ePHI, so service disruptions from crashes may pose risks if not mitigated.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using vulnerable versions of rdesktop (through 1.9.0). Update to the latest patched version if available. If updates are not possible, disable RDP client functionality or restrict connections to trusted servers only. Monitor for crashes or unusual activity in rdesktop sessions.

Useful 0 Not Useful 0