Receiving buffer underflow with RDP applet on handful of systems

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When RDPing to Windows servers, connection is established but after an interval of 30 seconds to about two minutes, the error below is posed and the RDP session is closed:

Error type: ArrayIndexOutOfBoundsException.
Error message: Buffer underflow.

Stack trace:
   com.ca.xsuite.app.rdp3.core.impl.Packet.getLittleEndian32(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.channel.SmartCardChannel.findProcessor(Unknown Source)
   com.ca.xsuite.app.rdp3.client.layer.channel.ClientSmartCardChannel.findProcessor(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.Layer.process(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.Layer.process(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.Layer.process(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.Layer.process(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.Layer.process(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.ITULayer.doProcessing(Unknown Source)
   com.ca.xsuite.app.rdp3.core.layer.ITULayer.mainLoop(Unknown Source)
   com.ca.xsuite.app.rdp3.client.app.RDesktop.main(Unknown Source)
   com.ca.xsuite.launcher.a.n.run(Unknown Source)
   java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   java.lang.Thread.run(Thread.java:750)

Environment

PAM 4.0.5, 4.1.1 and 4.1.2

Cause

This issue is only reproducible when Smart Cards (PIV/PKI) drivers are installed on the PAM Client Workstation/Laptop. 

When RDP applet receives a SCARD_IOCTL_WRITECACHEW type packet to process from the RDP Server, It processes this packet using the ClientWriteCacheEventHandler.java and puts the data (if any) into its internal cache. Sometimes this packet contains no data part (that is, associated data length is  zero).  The zero data length indicates there is nothing to cache and no further processing of such a packet is required. In this case, the code failed to  mark the processing of such a packet as complete. Further processing of this this packet results into an underflow condition as there is no data left to process.

Resolution

Issue has been fixed and fix is part of PAM 4.0.5.01 and 4.1.3