PT-2004-3545 · Rdesktop+1 · Rdesktop+1

Published 2004-12-31 · Updated 2018-10-03 · CVE-2004-2655

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions rdesktop version 1.3.1

Description The issue occurs when rdesktop is used in conjunction with xscreensaver, specifically version 4.14, on Fedora and possibly other platforms. When xscreensaver starts, rdesktop fails to release the keyboard focus, resulting in the password being entered into the active window when the user unlocks the screen.

Recommendations For rdesktop version 1.3.1, consider disabling the use of xscreensaver as a temporary workaround until a patch is available. Restrict access to sensitive information when the screen is locked to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2655

RHSA-2006:0498

Affected Products

Rdesktop

Xscreensaver

References · 21

• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2655 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_23_sr.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:071 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0498.html · Vendor Advisory
• https://usn.ubuntu.com/269-1 · Vendor Advisory
• http://securityfocus.com/bid/17471 · Patch
• https://security-tracker.debian.org/tracker/CVE-2004-2655 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-2655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2655 · Security Note
• http://secunia.com/advisories/20456 · Note
• http://secunia.com/advisories/20782 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm · Note
• http://secunia.com/advisories/22080 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10096 · Note