Description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rdesktop rdesktop
Default version status: unaffected
0 to ≤ 1.9.0affected
pkg:github/rdesktop/rdesktopReferences
- https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read ↗
- https://github.com/rdesktop/rdesktop/issues/436 ↗
- https://github.com/rdesktop/rdesktop/pull/437 ↗
- https://github.com/rdesktop/rdesktop/blob/v1.9.0/bitmap.c ↗
- https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-plane ↗