PT-2008-1022 · Rdesktop+1 · Rdesktop+1
Published
2008-05-12
·
Updated
2024-06-15
·
CVE-2008-1801
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
rdesktop versions 1.2.0 through 1.5.0
rdesktop versions prior to 1.6.0
Description
The issue affects the rdesktop package, allowing remote attackers to exploit it and potentially lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely. Specifically, an integer underflow in the
iso recv msg function in iso.c allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.Recommendations
For rdesktop versions 1.2.0 through 1.5.0, update to version 1.6.0 or later to resolve the issue.
For rdesktop versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
iso recv msg function in iso.c to minimize the risk of exploitation.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Rdesktop