Bug 445826 (CVE-2008-1802)

iDefense published advisory affecting rdesktop:

DESCRIPTION:
Remote exploitation of a BSS overflow vulnerability in rdesktop, as included in
various vendors' operating system distributions, allows attackers to execute
arbitrary code with the privileges of the logged-in user.

The vulnerability exists within the code responsible for reading in an RDP
redirect request. This request is used to redirect an RDP connection from one
server to another. When parsing the redirect request, the rdesktop client reads
several 32-bit integers from the request packet. These integers are then used
to control the number of bytes read into statically allocated buffers. This
results in several buffers located in the BSS section being overflowed, which
can lead to the execution of arbitrary code.

ANALYSIS:
Exploitation of this vulnerability results in the execution of arbitrary code
with the privileges of the logged in user. In order to exploit this
vulnerability, an attacker must persuade a targeted user to connect to a
malicious RDP server.

Reference:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=697

Upstream patch:
http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdp.c?r1=1.101&r2=1.102&pathrev=HEAD