Bug 255148 – net-misc/xrdp arbitrary code execution (CVE-2008-{5902,5903,5904})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Stefan Behte (RETIRED) 2009-01-16 10:34:38 UTC]

CVE-2008-5902 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5902):
  Buffer overflow in the xrdp_bitmap_invalidate function in
  xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers
  to execute arbitrary code via a crafted request.

[Comment 1 Stefan Behte (RETIRED) 2009-01-16 10:43:54 UTC]

CVE-2008-5903 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5903):
  Array index error in the xrdp_bitmap_def_proc function in
  xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to
  execute arbitrary code via vectors that manipulate the value of the
  edit_pos structure member.

CVE-2008-5904 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5904):
  The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in
  xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown
  impact via input data that sets crafted values for certain length
  variables, leading to a buffer overflow.

[Comment 2 Stefan Behte (RETIRED) 2009-05-02 19:38:45 UTC]

chutzpah, do you plan to update this?

[Comment 3 Robert Buchholz (RETIRED) 2009-08-07 01:00:05 UTC]

Created attachment 200457 [details, diff]
0001-fix-overflow-when-typing-in-edit-on-login-screen.patch

[Comment 4 Robert Buchholz (RETIRED) 2009-08-07 01:00:29 UTC]

Created attachment 200458 [details, diff]
0002-fix-some-buffer-overruns.patch

upstream patches. please bump

[Comment 5 Diego Elio Pettenò (RETIRED) 2010-09-27 13:05:43 UTC]

Security, this package has been removed from portage as of this moment, feel free to handle as you best see fit.

[Comment 6 Stefan Behte (RETIRED) 2010-10-07 21:41:33 UTC]

Closing noglsa, thanks everyone.