Critical Heap-Based Buffer Overflow in rdesktop Package
Summary
ALPINE-CVE-2018-8793: rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution. Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops and servers. It is widely used for remote access due to its lightweight nature and compatibility with various operating systems. However, certain versions of rdesktop are vulnerable to a critical heap-based buffer overflow, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-8793, exists in rdesktop versions up to and including v1.8.3. It is caused by a heap-based buffer overflow in the function cssp_read_tsrequest(). This flaw can lead to memory corruption and potentially allow an attacker to execute arbitrary code remotely. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level that necessitates immediate attention.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider restricting access to the rdesktop service or using alternative remote desktop solutions until the vulnerability can be addressed.
Conclusion
The rdesktop package is vulnerable to a critical heap-based buffer overflow, which can lead to severe security implications, including remote code execution. It is crucial for users to update to version 1.8.6-r0 or later to mitigate this risk. For those unable to update immediately, implementing access restrictions is recommended.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-8793 is a critical vulnerability in the rdesktop package that allows for a heap-based buffer overflow, potentially leading to remote code execution.
All versions of rdesktop up to and including v1.8.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an update is not possible, consider implementing access restrictions to the rdesktop service as a temporary measure.
The CVSS score for CVE-2018-8793 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
