xrdp Out-of-Bounds Read Vulnerability in RDP Capability Exchange Phase

A out-of-bounds read vulnerability has been identified in xrdp, an open-source RDP server, in versions prior to 0.10.6. The vulnerability occurs during the RDP capability exchange phase, where memory is accessed without proper validation of the remaining buffer length. This flaw allows remote, unauthenticated attackers to send specially crafted Confirm Active PDUs, potentially leading to a process crash (denial-of-service) or unauthorized disclosure of sensitive information from the process memory.

Impact

Exploitation of this vulnerability can cause a process crash, leading to a denial-of-service condition. Additionally, there is a risk of disclosing sensitive information from the process memory.

Remediation

Users can upgrade to xrdp version 0.10.6 to address this vulnerability.