Out-Of-Bounds Read Vulnerability in rdesktop Package
Summary
ALPINE-CVE-2018-8791: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak. Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops from Unix-like operating systems. It is widely used for remote access and management of Windows servers and desktops. The package is known for its lightweight design and compatibility with various RDP features. However, certain versions of rdesktop are vulnerable to an Out-Of-Bounds Read, which can lead to information leaks.
Vulnerability Detail
The vulnerability identified as CVE-2018-8791 affects rdesktop versions up to and including v1.8.3. It originates from an Out-Of-Bounds Read in the function rdpdr_process(), which can expose sensitive information to unauthorized users. This flaw can be exploited by attackers to gain access to confidential data, potentially leading to further security breaches. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the rdesktop service or using alternative remote desktop solutions until the package can be updated. Additionally, monitor your systems for any unusual activity that may indicate exploitation attempts.
Conclusion
The Out-Of-Bounds Read vulnerability in the rdesktop package poses a significant risk, allowing unauthorized access to sensitive information. It is crucial to update to the patched version 1.8.6-r0 or later to mitigate this risk. Users should also consider implementing workarounds and monitoring their systems for any signs of exploitation.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-8791 is a vulnerability in the rdesktop package that allows for an Out-Of-Bounds Read, potentially leading to information leaks.
Versions of rdesktop up to and including v1.8.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider restricting access to the rdesktop service and monitoring for unusual activity.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
