Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Jan 2009 12:08:12 +0100
From: Thomas Biege <>
Subject: CVE request: xrdp

this one is a bit older but seems not to have CVE-IDs assigned yet.

Multiple vulnerabilities in xrdp 
Discovered by: Hamid Ebadi
CSIRT Team Member
Amirkabir University CSIRT Laboratory (APA Laboratory)
Based on the work of rdesktop, xrdp uses the remote desktop protocol to present a
GUI to the user. The goal of this project is to provide a fully functional Linux
terminal server, capable of accepting connections from rdesktop and Microsoft's own 
terminal server / remote desktop clients. (
There are multiple buffer overflow vulnerabilities in xrdp which could be used by
malicious attackers to execute arbitary code on the system.
Vulnerable version
xrdp <=0.4.1

 Thomas Biege <>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.