Critical Integer Overflow Vulnerability in rdesktop Package
Summary
ALPINE-CVE-2018-20177: rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code executi... Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops remotely. It is widely used in various environments due to its lightweight nature and compatibility with multiple operating systems. However, certain versions of rdesktop are vulnerable to a critical integer overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2018-20177 affects rdesktop versions up to and including v1.8.3. It originates from an integer overflow in the function rdp_in_unistr(), which can lead to a heap-based buffer overflow. This memory corruption can potentially allow an attacker to execute arbitrary code remotely, posing a significant threat to system integrity and confidentiality.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using vulnerable versions of rdesktop until they can apply the patch. Additionally, restricting access to the rdesktop service or using alternative remote desktop solutions may mitigate the risk.
Conclusion
The rdesktop package has a critical vulnerability (CVE-2018-20177) that can lead to severe security risks, including remote code execution. Users are strongly advised to update to the patched version 1.8.6-r0 or later to mitigate these risks. For those unable to update immediately, alternative measures should be considered.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-20177 is a critical vulnerability in the rdesktop package that can lead to remote code execution due to an integer overflow.
All versions of rdesktop up to and including v1.8.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-20177 is 9.8, indicating a critical level of severity.
If an immediate update is not possible, consider using alternative remote desktop solutions or restricting access to the rdesktop service as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
