Denial of Service Vulnerability in rdesktop: Out-Of-Bounds Read
Summary
ALPINE-CVE-2018-20178: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault). Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops and servers. It is widely used for remote access due to its lightweight nature and compatibility with various operating systems. However, certain versions of rdesktop are vulnerable to an Out-Of-Bounds Read, which can lead to a Denial of Service (DoS) condition.
Vulnerability Detail
The vulnerability identified as CVE-2018-20178 affects rdesktop versions up to and including v1.8.3. It originates from a flaw in the function process_demand_active(), which does not properly handle certain input, leading to an Out-Of-Bounds Read. This can result in a segmentation fault, causing the application to crash and denying service to legitimate users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider restricting access to the rdesktop service or using alternative remote desktop solutions until the package is updated.
Conclusion
The rdesktop package has a critical vulnerability that can lead to a Denial of Service. It is essential to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for rdesktop →
FAQ
The vulnerability can lead to a Denial of Service (DoS) condition, causing the application to crash and preventing legitimate users from accessing the service.
rdesktop versions up to and including v1.8.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package right away, consider implementing access restrictions to the rdesktop service as a temporary measure.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
