Critical Integer Signedness Vulnerability in rdesktop Package
Summary
ALPINE-CVE-2018-20175: rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault). Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops and servers. It is widely used for remote access and management of Windows systems from Linux and Unix-like operating systems. The package is known for its lightweight nature and ease of use, but it has been found to contain vulnerabilities that can lead to serious security issues.
Vulnerability Detail
The vulnerability identified as CVE-2018-20175 affects rdesktop versions up to and including v1.8.3. It is caused by several Integer Signedness errors in the file mcs.c, which can lead to Out-Of-Bounds Reads. This vulnerability can result in a Denial of Service (DoS) condition, causing the application to crash (segfault). Attackers can exploit this vulnerability to disrupt services, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the rdesktop service or implement network-level protections to mitigate potential exploitation until the package is updated.
Conclusion
The rdesktop package has a critical vulnerability (CVE-2018-20175) that can lead to Denial of Service due to Integer Signedness errors. Users are strongly advised to update to version 1.8.6-r0 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-20175 is a vulnerability in the rdesktop package that can lead to Denial of Service due to Integer Signedness errors.
You can check your rdesktop version by running 'rdesktop -version' in your terminal. If it is 1.8.3 or lower, it is affected.
Failure to fix this vulnerability can lead to service disruptions and potential exploitation by attackers, resulting in a Denial of Service.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
