1. CVE-Search
  2. CVE-2018-20181
ID CVE-2018-20181
Summary rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.
References
Vulnerable Configurations
  • cpe:2.3:a:rdesktop:rdesktop:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:
CWE CWE-191
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 106938
confirm https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/
debian DSA-4394
gentoo GLSA-201903-06
misc https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
mlist [debian-lts-announce] 20190219 [SECURITY] [DLA 1683-1] rdesktop security update
suse openSUSE-SU-2019:2135
Last major update 24-08-2020 - 17:37
Published 15-03-2019 - 18:29
Last modified 24-08-2020 - 17:37
Back to Top