Out-of-Bounds Read Vulnerability in rdesktop
Summary
CVE-2018-20178: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault). Affects rdesktop across 2 version ranges.
< 1.8.6-r0
< 4dca546d04321a610c1835010b5dad85163b65e1
Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rdesktop is an open-source client for remote desktop services. It allows users to connect to a remote Windows desktop and interact with it as if they were using a local machine. The vulnerability, identified as CVE-2018-20178, affects rdesktop versions up to and including v1.8.3. It is an Out-of-Bounds Read vulnerability that occurs in the process_demand_active() function. Exploiting this vulnerability can lead to a Denial of Service (segfault) attack.
Vulnerability Detail
The Out-of-Bounds Read vulnerability in rdesktop arises due to improper handling of input data in the process_demand_active() function. An attacker can exploit this vulnerability by sending specially crafted input to the vulnerable function, causing it to read data beyond the bounds of the allocated memory. This can result in a segmentation fault, leading to a Denial of Service condition. The impact of this vulnerability is limited to a crash of the rdesktop application, and it does not allow for remote code execution or privilege escalation.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of rdesktop to ensure the security of the system.
Conclusion
The Out-of-Bounds Read vulnerability in rdesktop can be mitigated by updating the software to version 1.8.6-r0 or later. This update addresses the vulnerability and prevents potential Denial of Service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rdesktop →
FAQ
rdesktop is an open-source client for remote desktop services, allowing users to connect to a remote Windows desktop and interact with it.
The vulnerability can lead to a Denial of Service (segfault) attack, causing the rdesktop application to crash.
No, this vulnerability only leads to a crash of the rdesktop application and does not allow for remote code execution or privilege escalation.
To fix this vulnerability, update rdesktop to version 1.8.6-r0 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
