xrdp Heap-Based Buffer Overflow Vulnerability in Logon Processing

A heap-based buffer overflow vulnerability has been identified in xrdp, an open-source RDP server, in versions prior to 0.10.6. The vulnerability arises in the logon processing, specifically when the 'domain_user_separator' is configured in 'xrdp.ini'. In such cases, an unauthenticated remote attacker can send a crafted, excessively long username and domain name, leading to the overflow of an internal buffer. This overflow can corrupt adjacent memory regions, potentially causing a denial-of-service condition or unexpected behavior. Notably, the 'domain_name_separator' directive is commented out by default, so systems are only affected if this configuration is intentionally applied.

Impact

Exploitation of this vulnerability can cause a heap-based buffer overflow, allowing for memory corruption that could lead to a denial-of-service condition or unpredictable application behavior.

Remediation

Users can upgrade to xrdp version 0.10.6 to address this vulnerability.