Out-Of-Bounds Read Vulnerability in rdesktop Package
Summary
ALPINE-CVE-2018-20174: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak. Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops from Unix-like systems. It is widely used for remote access and management of Windows servers and workstations. The package is known for its lightweight design and ease of use, but it has been found to have a critical vulnerability that could expose sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2018-20174 affects rdesktop versions up to and including v1.8.3. It is characterized by an Out-Of-Bounds Read in the function ui_clip_handle_data(). This flaw can lead to an information leak, potentially allowing attackers to access sensitive data that should not be exposed. The vulnerability arises from improper handling of input data, which can be exploited to read memory locations beyond the intended buffer, thus compromising the confidentiality of the system.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider restricting access to the rdesktop service or using alternative remote desktop solutions until the vulnerability can be patched. Additionally, monitor your systems for any unusual activity that may indicate exploitation attempts.
Conclusion
The Out-Of-Bounds Read vulnerability in the rdesktop package poses a significant risk to systems utilizing this software. It is crucial to update to the patched version 1.8.6-r0 to mitigate the risk of information leaks. Users should also consider monitoring their systems for any signs of exploitation.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-20174 is a vulnerability in the rdesktop package that allows for an Out-Of-Bounds Read, potentially leading to information leaks.
All versions of rdesktop up to and including v1.8.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider restricting access to the rdesktop service and monitoring for unusual activity.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
