xrdp vulnerabilities

The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.

xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.

xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.

An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.

xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.

xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.

xrdp versions up to 0.10.6 have a vulnerability in processing Client Control PDUs. Insufficient length validation before reading data can lead to out-of-bounds memory reads by a remote, unauthenticated attacker. This results in a crash of the xrdp process (Denial of Service), but not the entire service, as xrdp forks a new process per connection by default.

xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).

Vulnerability in xrdp due to improper validation of the totalLength field in the RDP protocol header. An unauthenticated attacker can send a crafted packet, causing an infinite CPU loop and resource exhaustion.

xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).

Heap-based buffer overflow in the virtual channel forwarding mechanism in xrdp versions 0.10.6 and earlier. An authenticated remote attacker can send a crafted virtual channel message, causing heap memory corruption.

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to response time discrepancies, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. Fixed in version 0.10.6.1.

Integer overflow vulnerability in xrdp when processing screen updates in vnc-any mode. A malicious VNC server can send crafted image dimensions, leading to incorrect memory allocation and out-of-bounds read.

xrdp through 0.10.5 allows an authenticated remote user to execute arbitrary commands due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When AllowAlternateShell is enabled (default), the client-supplied value is executed via /bin/sh -c during session initialization. This is fixed in version 0.10.6.

xrdp through version 0.10.5 contains a heap-based buffer overflow in logon processing. When domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer, corrupting adjacent memory and potentially causing a Denial of Service (DoS) or unexpected behavior.

xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions.