CyberRota Analysis
AI-GeneratedThe xrdp server versions prior to 0.10.6.1 are vulnerable to a denial-of-service attack due to insufficient length validation when processing Client Control PDUs, allowing remote, unauthenticated attackers to send specially crafted packets that may lead to out-of-bounds memory reads. While this vulnerability primarily risks service termination for individual connections, it does not compromise the entire xrdp service due to its process management design. Organizations using affected versions should prioritize upgrading to the patched version to mitigate potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted, truncated Client Control PDU. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service.This issue has been fixed in version 0.10.6.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)