Out-Of-Bounds Read Vulnerability in rdesktop: Denial of Service Risk
Summary
ALPINE-CVE-2018-8799: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault). Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops from Unix-like systems. It is widely used for remote access and management of Windows servers and workstations. The package is known for its lightweight design and ease of use, but it has been found to have a critical vulnerability that can lead to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2018-8799 affects rdesktop versions up to and including v1.8.3. It is characterized by an Out-Of-Bounds Read in the function process_secondary_order(), which can lead to a Denial of Service (DoS) condition, specifically a segmentation fault (segfault). This vulnerability can be exploited by sending specially crafted data to the rdesktop client, causing it to crash and become unresponsive, thereby impacting the availability of services relying on it.
How To Fix
Minimum fixed version
1.8.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level controls to restrict access to the rdesktop service, thereby mitigating the risk of exploitation until the update can be applied.
Conclusion
The rdesktop package has a critical vulnerability (CVE-2018-8799) that can lead to Denial of Service due to an Out-Of-Bounds Read. Users are strongly advised to update to version 1.8.6-r0 or later to mitigate this risk. In the meantime, network restrictions can help protect against potential exploitation.
See every vulnerability recorded for rdesktop →
FAQ
CVE-2018-8799 is a vulnerability in rdesktop that allows for an Out-Of-Bounds Read, potentially leading to a Denial of Service.
Any version of rdesktop up to and including 1.8.3 is vulnerable. You can check your version using the command rdesktop -v.
Exploitation of this vulnerability can lead to a Denial of Service, causing the rdesktop client to crash and become unresponsive.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit https://vulert.com for more information.
Implement network-level restrictions to limit access to the rdesktop service until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
