Out-Of-Bounds Read Vulnerability in rdesktop Package
Summary
DEBIAN-CVE-2018-8792: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault). Affects rdesktop versions < 1.8.4-1. Fixed in 1.8.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops remotely. It is widely used for its lightweight design and compatibility with various operating systems. However, certain versions of rdesktop are susceptible to a critical vulnerability that can lead to denial of service.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2018-8792 is an Out-Of-Bounds Read in the function cssp_read_tsrequest() within rdesktop versions up to and including v1.8.3. This flaw can be exploited to cause a segmentation fault, resulting in a denial of service. Attackers can leverage this vulnerability to disrupt service availability, impacting users relying on remote desktop connections.
How To Fix
Minimum fixed version
1.8.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rdesktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling remote desktop services until the package is updated. However, this may not be feasible for all users, especially those who rely on remote access for their work.
Conclusion
The rdesktop package has a critical vulnerability that can lead to service disruption. It is essential for users to update their installations to the patched version to maintain service availability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rdesktop →
FAQ
It is an Out-Of-Bounds Read vulnerability that can lead to a denial of service.
Versions up to and including v1.8.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing the application to crash and become unavailable to users.
Yes, updating to rdesktop version 1.8.4-1 or later will resolve the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for rdesktop.
