Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Jan 2009 12:08:12 +0100
From: Thomas Biege <>
Subject: CVE request: xrdp

this one is a bit older but seems not to have CVE-IDs assigned yet.

Multiple vulnerabilities in xrdp 
Discovered by: Hamid Ebadi
CSIRT Team Member
Amirkabir University CSIRT Laboratory (APA Laboratory)
Based on the work of rdesktop, xrdp uses the remote desktop protocol to present a
GUI to the user. The goal of this project is to provide a fully functional Linux
terminal server, capable of accepting connections from rdesktop and Microsoft's own 
terminal server / remote desktop clients. (
There are multiple buffer overflow vulnerabilities in xrdp which could be used by
malicious attackers to execute arbitary code on the system.
Vulnerable version
xrdp <=0.4.1

 Thomas Biege <>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ