Neutrino Labs xrdp any version

xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.

xrdp: lib_palette_update Heap Buffer Overflow & RCE

Buffer Overflow in xrdp

Buffer Overflow occurs in xrdp

Buffer Overflow in xrdp

Out of Bound Write in xrdp

Buffer Overflow in xrdp

Integer Overflow in xrdp

xrdp allows an ininite number of login attempts

xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode

Out of Bound Read in xrdp

Out-of-Bound Read in libxrdp

xrdp: Pre-authentication out-of-bounds reads in channel parsers

Out-of-Bound Read in xrdp

Out-of-Bound Read in xrdp

xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers

xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass

xrdp: Heap buffer overflow in EGFX channel

xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails

The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly

xrdp: No authentication required with Xvnc backend on RHEL 9

Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it

xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

Improper handling of session establishment errors in xrdp

Unchecked access to font glyph info in xrdp

xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation

xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman

xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads

xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

XRDP is vulnerable to a server timing attack, leading to user enumeration