1. CVE-Search
  2. CVE-2018-8793
ID CVE-2018-8793
Summary rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.
References
Vulnerable Configurations
  • cpe:2.3:a:rdesktop:rdesktop:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 29-09-2020 - 01:40)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 106938
confirm https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/
debian DSA-4394
gentoo GLSA-201903-06
misc https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
mlist [debian-lts-announce] 20190219 [SECURITY] [DLA 1683-1] rdesktop security update
suse openSUSE-SU-2019:2135
Last major update 29-09-2020 - 01:40
Published 05-02-2019 - 20:29
Last modified 29-09-2020 - 01:40
Back to Top