Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.

From Red Hat Security Advisory 2008:0576 :

Updated rdesktop packages that fix a security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

rdesktop is an open source client for Microsoft Windows NT Terminal Server and Microsoft Windows 2000 and 2003 Terminal Services, capable of natively using the Remote Desktop Protocol (RDP) to present the user's NT desktop. No additional server extensions are required.

An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

Users of rdesktop should upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0575 advisory.

    [1.4.1-6]
    - Update the prototype for xrealloc() as well.
    - Fix bug 452978, cve-2008-1803
    - Fix bug 452978, cve-2008-1801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An integer underflow and integer signedness issue were discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801, CVE-2008-1803)

An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

Additionally, the following bug was fixed :

A missing command line option caused rdesktop to fail when using the krdc remote desktop utility. Using krdc to connect to a terminal server resulted in errors such as the following :

The version of rdesktop you are using ([version]) is too old :

rdesktop [version] or greater is required. A working patch for rdesktop [version] can be found in KDE CVS.

In this updated package, krdc successfully connects to terminal servers.

An updated rdesktop package that fixes a security issue is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

rdesktop is an open source client for Microsoft Windows NT Terminal Server and Microsoft Windows 2000 and 2003 Terminal Services, capable of natively using the Remote Desktop Protocol (RDP) to present the user's NT desktop. No additional server extensions are required.

An integer underflow and integer signedness issue were discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801, CVE-2008-1803)

Users of rdesktop should upgrade to these updated packages, which contain a backported patches to resolve these issues.

It was discovered that rdesktop did not properly validate the length of packet headers when processing RDP requests. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user. (CVE-2008-1801)

Multiple buffer overflows were discovered in rdesktop when processing RDP redirect requests. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user.
(CVE-2008-1802)

It was discovered that rdesktop performed a signed integer comparison when reallocating dynamic buffers which could result in a heap-based overflow. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user.
(CVE-2008-1802).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in rdesktop, a Remote Desktop Protocol client.

An integer underflow vulnerability allowed attackers to cause a denial of service (crash) and possibly execute arbitrary code with the privileges of the logged-in user (CVE-2008-1801).

A buffer overflow vulnerability allowed attackers to execute arbitrary code with the privileges of the logged-in user (CVE-2008-1802).

An integer signedness vulnerability allowed attackers to execute arbitrary code with the privileges of the logged-in user (CVE-2008-1803).

In order for these vulnerabilities to be exploited, an attacker must persuade a targeted user to connect to a malicious RDP server.

The updated packages have been patched to correct these issues.

Multiple problems have been fixed in rdesktop. CVE-2008-1801, CVE-2008-1802 and CVE-2008-1803 have been assigned to this issue.

Multiple problems have been fixed in rdesktop. CVE-2008-1801 / CVE-2008-1802 / CVE-2008-1803 have been assigned to this issue.

Updated rdesktop packages that fix a security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

rdesktop is an open source client for Microsoft Windows NT Terminal Server and Microsoft Windows 2000 and 2003 Terminal Services, capable of natively using the Remote Desktop Protocol (RDP) to present the user's NT desktop. No additional server extensions are required.

An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

Users of rdesktop should upgrade to these updated packages, which contain a backported patch to resolve this issue.

Updated rdesktop packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

rdesktop is an open source client for Microsoft Windows NT Terminal Server and Microsoft Windows 2000 and 2003 Terminal Services, capable of natively using the Remote Desktop Protocol (RDP) to present the user's NT desktop. No additional server extensions are required.

An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

Additionally, the following bug was fixed :

A missing command line option caused rdesktop to fail when using the krdc remote desktop utility. Using krdc to connect to a terminal server resulted in errors such as the following :

The version of rdesktop you are using ([version]) is too old :

rdesktop [version] or greater is required. A working patch for rdesktop [version] can be found in KDE CVS.

In this updated package, krdc successfully connects to terminal servers.

Users of rdesktop should upgrade to these updated packages, which contain a backported patches to resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200806-04 (rdesktop: Multiple vulnerabilities)

    An anonymous researcher reported multiple vulnerabilities in rdesktop     via iDefense Labs:
    An integer underflow error exists in     the function iso_recv_msg() in the file iso.c which can be triggered     via a specially crafted RDP request, causing a heap-based buffer     overflow (CVE-2008-1801).
    An input validation error exists in     the function process_redirect_pdu() in the file rdp.c which can be     triggered via a specially crafted RDP redirect request, causing a     BSS-based buffer overflow (CVE-2008-1802).
    An integer signedness error exists in the function xrealloc() in the     file rdesktop.c which can be be exploited to cause a heap-based buffer     overflow (CVE-2008-1803).
  Impact :

    An attacker could exploit these vulnerabilities by enticing a user to     connect to a malicious RDP server thereby allowing the attacker to     execute arbitrary code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New rdesktop packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix a security issue caused by using rdesktop to connect to a malicious or compromised RDP server.

- Tue May 13 2008 Soren Sandmann <sandmann at redhat.com>
    - 1.6.0-1

    - Update to 1.6.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in rdesktop, a Remote Desktop Protocol client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1801     Remote exploitation of an integer underflow     vulnerability allows attackers to execute arbitrary code     with the privileges of the logged-in user.

  - CVE-2008-1802     Remote exploitation of a BSS overflow vulnerability     allows attackers to execute arbitrary code with the     privileges of the logged-in user.

  - CVE-2008-1803     Remote exploitation of an integer signedness     vulnerability allows attackers to execute arbitrary code     with the privileges of the logged-in user.

ID	Name	Product	Family	Severity
67720	Oracle Linux 3 : rdesktop (ELSA-2008-0576)	Nessus	Oracle Linux Local Security Checks	high
67719	Oracle Linux 5 : rdesktop (ELSA-2008-0575)	Nessus	Oracle Linux Local Security Checks	critical
60454	Scientific Linux Security Update : rdesktop on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60453	Scientific Linux Security Update : rdesktop on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60384	Scientific Linux Security Update : rdesktop on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43696	CentOS 5 : rdesktop (CESA-2008:0575)	Nessus	CentOS Local Security Checks	high
38000	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : rdesktop vulnerabilities (USN-646-1)	Nessus	Ubuntu Local Security Checks	high
37563	Mandriva Linux Security Advisory : rdesktop (MDVSA-2008:101)	Nessus	Mandriva Local Security Checks	high
33898	openSUSE 10 Security Update : rdesktop (rdesktop-5271)	Nessus	SuSE Local Security Checks	high
33889	SuSE 10 Security Update : rdesktop (ZYPP Patch Number 5272)	Nessus	SuSE Local Security Checks	high
33735	CentOS 3 : rdesktop (CESA-2008:0576)	Nessus	CentOS Local Security Checks	high
33584	RHEL 4 : rdesktop (RHSA-2008:0725)	Nessus	Red Hat Local Security Checks	high
33579	RHEL 3 : rdesktop (RHSA-2008:0576)	Nessus	Red Hat Local Security Checks	high
33578	RHEL 5 : rdesktop (RHSA-2008:0575)	Nessus	Red Hat Local Security Checks	high
33189	GLSA-200806-04 : rdesktop: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
32446	Slackware 11.0 / 12.0 / 12.1 / current : rdesktop (SSA:2008-148-01)	Nessus	Slackware Local Security Checks	high
32349	Fedora 7 : rdesktop-1.6.0-1.fc7 (2008-3985)	Nessus	Fedora Local Security Checks	high
32343	Fedora 8 : rdesktop-1.6.0-1.fc8 (2008-3917)	Nessus	Fedora Local Security Checks	high
32338	Fedora 9 : rdesktop-1.6.0-1.fc9 (2008-3886)	Nessus	Fedora Local Security Checks	high
32307	Debian DSA-1573-1 : rdesktop - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-1801

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high