Integer Overflow in xrdp Leading to Out-of-Bounds Read

Executive Summary

xrdp versions 0.10.6 and prior have an integer overflow vulnerability when processing screen update messages in the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, leading to an undersized allocation. This results in an out-of-bounds read when processing the image data with the original oversized parameters.

Useful 0 Not Useful 0

Detection Guidance

Check if your xrdp version is 0.10.6 or earlier by running: xrdp --version. If vulnerable, inspect network traffic for VNC connections using tools like tcpdump or Wireshark to detect unusual image dimension parameters.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service via a process crash.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized disclosure of sensitive information from heap memory due to the out-of-bounds read. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. The flaw allows attackers to access such data, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade xrdp to version 0.10.6.1 or later. Alternatively, disable the vnc-any section in xrdp.ini or remove configurations allowing arbitrary VNC host connections to prevent exploitation.

Useful 0 Not Useful 0