xrdp - Denial of Service Vulnerability
Summary
DLA-1203-2: xrdp - regression update. Affects xrdp versions < 0.5.0-2+deb7u3. Fixed in 0.5.0-2+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xrdp is a remote desktop protocol (RDP) server that allows users to connect to a Linux machine remotely. It provides a graphical interface for remote access and is commonly used for remote administration or accessing Linux servers from Windows machines. The vulnerability in xrdp allows local users to cause a denial of service (DoS) or potentially have other unspecified impacts by exploiting a buffer overflow in the scp_v0s_accept function in the session manager.
Vulnerability Detail
The scp_v0s_accept function in xrdp's session manager uses an untrusted integer as a write length. This allows local users to craft a malicious input stream that can trigger a buffer overflow and crash the application. The exact impact of this vulnerability is unspecified, but it could potentially lead to remote code execution or other security breaches.
How To Fix
Minimum fixed version
0.5.0-2+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xrdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the xrdp package to the patched version.
Conclusion
The xrdp package on Debian 7 Wheezy is vulnerable to a buffer overflow issue that can be exploited by local users to cause a denial of service or potentially have other impacts. It is recommended to upgrade the xrdp package to version 0.5.0-2+deb7u2 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for xrdp →
FAQ
xrdp is a remote desktop protocol (RDP) server for Linux that allows users to connect to a Linux machine remotely.
Any system running xrdp version 0.5.0-2 or earlier on Debian 7 Wheezy is affected by this vulnerability.
The vulnerability allows local users to cause a denial of service (DoS) or potentially have other unspecified impacts, such as remote code execution.
No, there is no known workaround for this vulnerability. It is crucial to upgrade the xrdp package to the patched version.
To fix this vulnerability, you need to upgrade the xrdp package to version 0.5.0-2+deb7u2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for xrdp.
