Heap Out-of-Bounds Read in rdesktop

Executive Summary

This vulnerability is a heap out-of-bounds read flaw in rdesktop versions up to 1.9.0. It exists in the process_bmpcache2() function in orders.c. Malicious RDP servers can exploit this by sending crafted revision-2 bitmap cache orders with large width/height values or underflowing mode nibbles and short payloads. This causes memcpy() to read memory beyond the allocated buffer, leading to crashes and denial of service for client applications.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for RDP connections using tools like Wireshark or tcpdump to detect unusual bitmap cache orders. Check rdesktop logs for crashes or errors during RDP sessions. Inspect memory dumps if clients crash unexpectedly.

Useful 0 Not Useful 0

Impact Analysis

If you use rdesktop to connect to untrusted RDP servers, attackers could exploit this flaw to crash your client application. This would disrupt your remote desktop sessions and could potentially allow further malicious actions if combined with other vulnerabilities. The impact is primarily denial of service for the rdesktop client.

Useful 0 Not Useful 0

Mitigation Strategies

Update rdesktop to the latest version that patches this issue. Disable RDP connections from untrusted servers. Use alternative RDP clients like FreeRDP until the fix is applied.

Useful 0 Not Useful 0