Main Vulnerability Database Vulnerabilities #VU17679

Out-of-bounds read in rdesktop - CVE-2018-8791

Published: February 14, 2019 / Updated: May 18, 2020

Vulnerability identifier: #VU17679

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8791

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to an out-of-bounds read condition in the rdpdr_process() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and access sensitive information on the targeted system.

Affected software

rdesktop
Gentoo Linux
Arch Linux
SUSE Linux
Opensuse
Fedora
busybox (Alpine package)
rdesktop (Alpine package)
firefox-esr (Alpine package)
rdesktop

How to mitigate CVE-2018-8791

Update to version 1.8.4.

rdesktop - update to 1.8.4
rdesktop (Alpine package) - update to 1.8.6-r0
rdesktop - addressed in versions 1.8.4-2.fc28, 1.8.4-2.fc29

Links to Public Exploits and PoC-codes

Exploit #2701 - CPR-Zero: CVE-2018-8791 (May 18, 2020)

External References

https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1