Red Hat Bugzilla – Bug 675846
CVE-2011-0900 CVE-2011-0901 tsclient: multiple stack-based buffer overflows in tsc_launch_remote()
Last modified: 2016-03-04 05:49:06 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0900 to the following vulnerability: Name: CVE-2011-0900 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0900 Assigned: 20110207 Reference: http://www.exploit-db.com/exploits/16095 Reference: http://www.securityfocus.com/bid/46099 Reference: http://osvdb.org/70749 Reference: http://secunia.com/advisories/43120 Reference: http://xforce.iss.net/xforce/xfdb/65100 Stack-based buffer overflow in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a .RDP file with a long hostname argument. Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0901 to the following vulnerability: Name: CVE-2011-0901 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0901 Assigned: 20110207 Reference: URL: http://osvdb.org/70749 Reference: URL: http://secunia.com/advisories/43120 Reference: URL: http://xforce.iss.net/xforce/xfdb/65103 Reference: URL: http://xforce.iss.net/xforce/xfdb/65102 Reference: URL: http://xforce.iss.net/xforce/xfdb/65101 Multiple stack-based buffer overflows in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150, and possibly other versions, allow user-assisted remote attackers to execute arbitrary code via a .RDP file with a long (1) username, (2) password, or (3) domain argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
This issue is a crash only on Red Hat Enterprise Linux 5 and above. The cost of fixing this for Red Hat Enterprise Linux 4 is outweighed by the minimal risk presented. At this time Red Hat does not plan to fix this flaw.