Denial of Service Vulnerability in rdesktop Package: Out-Of-Bounds Reads
Summary
ALPINE-CVE-2018-20176: rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault). Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops remotely. It is widely used for its simplicity and effectiveness in providing remote access. However, certain versions of rdesktop are vulnerable to a critical issue that can lead to a Denial of Service (DoS) due to Out-Of-Bounds Reads.
Vulnerability Detail
The vulnerability identified as CVE-2018-20176 affects rdesktop versions up to and including v1.8.3. It originates from several Out-Of-Bounds Reads in the source file secure.c, which can cause the application to crash (segfault). This results in a Denial of Service, making the application unusable until it is restarted. Attackers can exploit this vulnerability to disrupt services, leading to potential downtime and loss of productivity.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the rdesktop service or implement network-level security measures to prevent unauthorized access while awaiting the patch.
Conclusion
The rdesktop package has a significant vulnerability that can lead to Denial of Service due to Out-Of-Bounds Reads. Users are strongly advised to update to the patched version to mitigate risks. For those unable to update immediately, temporary workarounds and security measures should be considered.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-20176 is a vulnerability in the rdesktop package that allows for Out-Of-Bounds Reads, leading to a Denial of Service.
All versions of rdesktop up to and including v1.8.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing network security measures to restrict access to the rdesktop service.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
