Bug 445826 - (CVE-2008-1802) CVE-2008-1802 rdesktop: process_redirect_pdu() BSS Overflow Vulnerability
CVE-2008-1802 rdesktop: process_redirect_pdu() BSS Overflow Vulnerability
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
source=internet,reported=20080507,pub...
: Security
Depends On: 445841 445842 445843
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-09 06:15 EDT by Tomas Hoger
Modified: 2008-06-23 12:39 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-23 12:39:16 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Public PoC (2.70 KB, text/plain)
2008-05-27 10:45 EDT, Tomas Hoger
no flags Details

  None (edit)
Description Tomas Hoger 2008-05-09 06:15:38 EDT
iDefense published advisory affecting rdesktop:

DESCRIPTION:
Remote exploitation of a BSS overflow vulnerability in rdesktop, as included in
various vendors' operating system distributions, allows attackers to execute
arbitrary code with the privileges of the logged-in user.

The vulnerability exists within the code responsible for reading in an RDP
redirect request. This request is used to redirect an RDP connection from one
server to another. When parsing the redirect request, the rdesktop client reads
several 32-bit integers from the request packet. These integers are then used
to control the number of bytes read into statically allocated buffers. This
results in several buffers located in the BSS section being overflowed, which
can lead to the execution of arbitrary code.

ANALYSIS:
Exploitation of this vulnerability results in the execution of arbitrary code
with the privileges of the logged in user. In order to exploit this
vulnerability, an attacker must persuade a targeted user to connect to a
malicious RDP server.

Reference:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=697

Upstream patch:
http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdp.c?r1=1.101&r2=1.102&pathrev=HEAD
Comment 5 Tomas Hoger 2008-05-14 02:12:05 EDT
Upstream released version 1.6.0 which address this issue:

http://sourceforge.net/mailarchive/message.php?msg_name=20080511065217.GA24455%40cse.unsw.EDU.AU
Comment 6 Fedora Update System 2008-05-14 18:08:22 EDT
rdesktop-1.6.0-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2008-05-14 18:12:33 EDT
rdesktop-1.6.0-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2008-05-14 18:15:15 EDT
rdesktop-1.6.0-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Tomas Hoger 2008-05-27 10:45:24 EDT
Created attachment 306785 [details]
Public PoC

http://www.milw0rm.com/exploits/5585
Comment 10 Jan Iven 2008-06-02 06:13:10 EDT
Could you clarify the status for the various RHELs?
Comment 11 Søren Sandmann Pedersen 2008-06-02 20:52:22 EDT
This vulnerability is in 1.5 which we have not shipped in any RHEL.
Comment 12 Tomas Hoger 2008-06-23 12:38:07 EDT
This vulnerability occurs in the Session Directory code that was only introduced
in upstream rdesktop version 1.5.0:

 rdesktop (1.5.0)
   [ ... ]
   * Session Directory support (patch from Brian Chapeau)

http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/doc/ChangeLog?view=markup

This issue did not affect the versions of rdesktop as shipped with Red Hat
Enterprise Linux 3, 4, or 5.

Note You need to log in before you can comment on or make changes to this bug.