PT-2008-1024 · Gentoo Linux Debian Gnu/Linux · Rdesktop

Published 2008-05-12 · Updated 2024-06-15 · CVE-2008-1802

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rdesktop versions prior to 1.6.0

Description The issue affects the rdesktop package in Gentoo Linux and Debian GNU/Linux operating systems, allowing remote exploitation that may lead to breaches in confidentiality, integrity, and availability of protected information. A buffer overflow in the process redirect pdu function in rdp.c can be triggered by a Remote Desktop Protocol (RDP) redirect request with modified length fields, potentially enabling remote attackers to execute arbitrary code.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the process redirect pdu function in rdp.c until a patch is available. Avoid using the RDP protocol with untrusted connections until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-02015

BDU:2015-09640

CVE-2008-1802

DSA-1573-1

OPENSUSE-SU-2024:11298-1

Affected Products

Rdesktop

References · 54

• 🔥 http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdp.c?r1=1.101&r2=1.102&pathrev=HEAD · Exploit
• 🔥 https://exploit-db.com/exploits/5585 · Exploit
• http://redhat.com/archives/fedora-package-announce/2008-May/msg00244.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1802 · Security Note
• http://security.gentoo.org/glsa/glsa-200806-04.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1802 · Vendor Advisory
• http://debian.org/security/2008/dsa-1573 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-240708-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1801 · Security Note
• https://bdu.fstec.ru/vul/2015-02015 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11298-1 · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-May/msg00270.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09640 · Security Note
• https://osv.dev/vulnerability/CVE-2008-1802 · Vendor Advisory
• http://ubuntu.com/usn/usn-646-1 · Vendor Advisory