Bug 445829 (CVE-2008-1803)

iDefense published advisory affecting rdesktop:

DESCRIPTION:
Remote exploitation of an integer signedness vulnerability in rdesktop, as
included in various vendors' operating system distributions, allows attackers
to execute arbitrary code with the privileges of the logged-in user.

The vulnerability exists within the code responsible for reallocating dynamic
buffers. The rdesktop xrealloc() function uses a signed comparison to determine
if the requested allocation size is less than 1. When this occurs, the function
will incorrectly set the allocation size to be 1. This results in an improperly
sized heap buffer being allocated, which can later be overflowed.

ANALYSIS:
Exploitation of this vulnerability results in the execution of arbitrary code
with the privileges of the logged in user. In order to exploit this
vulnerability, an attacker must persuade a targeted user to connect to a
malicious RDP server. 

Reference:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=698

Upstream patch:
http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdesktop.c?r1=1.161&r2=1.162