CVE Feed

    Dashboard / CVE / CVE-2018-20179

    CVE-2018-20179

    rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.

    Published:Jan 4, 2019
    Last Modified:Nov 21, 2024
    EPS:Mar 15, 2019
    EPSS Score:0.07649
    CVSS Score:9.8

    Affected Products

    Vendor
    Rdesktop
    Product
    Rdesktop

    Exploits

    https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/

    Related CVEs

    CVE-2019-15682 (CVSS 7.5) — RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results i…
    CVE-2018-20178 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_acti…
    CVE-2018-8794 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write …
    CVE-2018-20182 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the functi…
    CVE-2018-8791 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that re…
    CVE-2018-8792 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() t…
    CVE-2018-20180 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Ov…
    CVE-2018-8798 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() t…
    CVE-2018-8799 (CVSS 7.5) — rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order…
    CVE-2018-8800 (CVSS 9.8) — rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_d…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html
    http://www.securityfocus.com/bid/106938
    https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
    https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html
    https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/
    https://security.gentoo.org/glsa/201903-06
    https://www.debian.org/security/2019/dsa-4394
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html
    http://www.securityfocus.com/bid/106938
    https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
    https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html
    https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/
    https://security.gentoo.org/glsa/201903-06
    https://www.debian.org/security/2019/dsa-4394

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High