rustdeskandClaude Fable 5.1 1266b56150 kx_advertised: every message after the exchange, not the first alone ...

The contract named the server's first message after the key exchange. That
frame sits at a position an attacker needs no key to find, so one who had
lowered the advertisement in the clear only had to drop it to be rid of
the check for the whole session. With every message carrying the echo,
being rid of it means dropping them all, which is a plain DoS.

The client already kept the check armed until an echo arrived; this is the
wording the server side is written to.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab

2026-09-21 18:33:33 +08:00

examples

move the modules only rustdesk uses out to the base crate

2026-09-08 08:53:58 +08:00

protos

kx_advertised: every message after the exchange, not the first alone

2026-09-21 18:33:33 +08:00

src

kx_advertised: every message after the exchange, not the first alone

2026-09-21 18:33:33 +08:00

.gitignore

init

2025-01-20 16:06:27 +08:00

build.rs

move the modules only rustdesk uses out to the base crate

2026-09-08 08:53:58 +08:00

Cargo.toml

websocket: tungstenite 0.29 from rustdesk-org, read buffer grown as bytes arrive

2026-09-21 17:58:32 +08:00

S

Description

No description provided

75 MiB

Languages

Rust 100%