CVE Feed

    Dashboard / CVE / CVE-2008-1801

    CVE-2008-1801

    Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.

    Published:May 7, 2008
    Last Modified:Apr 23, 2026
    EPS:May 12, 2008
    EPSS Score:0.36728
    CVSS Score:9.3

    Affected Products

    Vendor
    Rdesktop
    Product
    Rdesktop
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/iso.c?r1=1.19&r2=1.20&pathrev=HEADhttp://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/iso.c?r1=1.19&r2=1.20&pathrev=HEADhttps://www.exploit-db.com/exploits/5561

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2019-15682 (CVSS 7.5) — RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results i…
    CVE-2018-20178 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_acti…
    CVE-2018-8794 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write …
    CVE-2018-20182 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the functi…
    CVE-2018-8791 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that re…
    CVE-2018-8792 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() t…
    CVE-2018-20180 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Ov…
    CVE-2018-8798 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() t…
    CVE-2018-8799 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order…
    CVE-2018-8800 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_d…

    References

    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=696
    http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/iso.c?r1=1.19&r2=1.20&pathrev=HEAD
    http://secunia.com/advisories/30118
    http://secunia.com/advisories/30248
    http://secunia.com/advisories/30380
    http://secunia.com/advisories/30713
    http://secunia.com/advisories/31222
    http://secunia.com/advisories/31224
    http://secunia.com/advisories/31928
    http://security.gentoo.org/glsa/glsa-200806-04.xml
    http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.395286
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-240708-1
    http://support.avaya.com/elmodocs2/security/ASA-2008-360.htm
    http://www.debian.org/security/2008/dsa-1573
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:101
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00244.html
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00270.html
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00296.html
    http://www.redhat.com/support/errata/RHSA-2008-0575.html
    http://www.redhat.com/support/errata/RHSA-2008-0576.html
    http://www.redhat.com/support/errata/RHSA-2008-0725.html
    http://www.securityfocus.com/bid/29097
    http://www.securitytracker.com/id?1019990
    http://www.ubuntu.com/usn/usn-646-1
    http://www.vupen.com/english/advisories/2008/1467/references
    http://www.vupen.com/english/advisories/2008/2403
    https://exchange.xforce.ibmcloud.com/vulnerabilities/42272
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11570
    https://www.exploit-db.com/exploits/5561
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=696
    http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/iso.c?r1=1.19&r2=1.20&pathrev=HEAD
    http://secunia.com/advisories/30118
    http://secunia.com/advisories/30248
    http://secunia.com/advisories/30380
    http://secunia.com/advisories/30713
    http://secunia.com/advisories/31222
    http://secunia.com/advisories/31224
    http://secunia.com/advisories/31928
    http://security.gentoo.org/glsa/glsa-200806-04.xml
    http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.395286
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-240708-1
    http://support.avaya.com/elmodocs2/security/ASA-2008-360.htm
    http://www.debian.org/security/2008/dsa-1573
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:101
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00244.html
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00270.html
    http://www.redhat.com/archives/fedora-package-announce/2008-May/msg00296.html
    http://www.redhat.com/support/errata/RHSA-2008-0575.html
    http://www.redhat.com/support/errata/RHSA-2008-0576.html
    http://www.redhat.com/support/errata/RHSA-2008-0725.html
    http://www.securityfocus.com/bid/29097
    http://www.securitytracker.com/id?1019990
    http://www.ubuntu.com/usn/usn-646-1
    http://www.vupen.com/english/advisories/2008/1467/references
    http://www.vupen.com/english/advisories/2008/2403
    https://exchange.xforce.ibmcloud.com/vulnerabilities/42272
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11570
    https://www.exploit-db.com/exploits/5561

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High