Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields.

It was discovered that rdesktop did not properly validate the length of packet headers when processing RDP requests. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user. (CVE-2008-1801)

Multiple buffer overflows were discovered in rdesktop when processing RDP redirect requests. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user.
(CVE-2008-1802)

It was discovered that rdesktop performed a signed integer comparison when reallocating dynamic buffers which could result in a heap-based overflow. If a user were tricked into connecting to a malicious server, an attacker could cause a denial of service or possible execute arbitrary code with the privileges of the user.
(CVE-2008-1802).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in rdesktop, a Remote Desktop Protocol client.

An integer underflow vulnerability allowed attackers to cause a denial of service (crash) and possibly execute arbitrary code with the privileges of the logged-in user (CVE-2008-1801).

A buffer overflow vulnerability allowed attackers to execute arbitrary code with the privileges of the logged-in user (CVE-2008-1802).

An integer signedness vulnerability allowed attackers to execute arbitrary code with the privileges of the logged-in user (CVE-2008-1803).

In order for these vulnerabilities to be exploited, an attacker must persuade a targeted user to connect to a malicious RDP server.

The updated packages have been patched to correct these issues.

Multiple problems have been fixed in rdesktop. CVE-2008-1801, CVE-2008-1802 and CVE-2008-1803 have been assigned to this issue.

Multiple problems have been fixed in rdesktop. CVE-2008-1801 / CVE-2008-1802 / CVE-2008-1803 have been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-200806-04 (rdesktop: Multiple vulnerabilities)

    An anonymous researcher reported multiple vulnerabilities in rdesktop     via iDefense Labs:
    An integer underflow error exists in     the function iso_recv_msg() in the file iso.c which can be triggered     via a specially crafted RDP request, causing a heap-based buffer     overflow (CVE-2008-1801).
    An input validation error exists in     the function process_redirect_pdu() in the file rdp.c which can be     triggered via a specially crafted RDP redirect request, causing a     BSS-based buffer overflow (CVE-2008-1802).
    An integer signedness error exists in the function xrealloc() in the     file rdesktop.c which can be be exploited to cause a heap-based buffer     overflow (CVE-2008-1803).
  Impact :

    An attacker could exploit these vulnerabilities by enticing a user to     connect to a malicious RDP server thereby allowing the attacker to     execute arbitrary code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

- Tue May 13 2008 Soren Sandmann <sandmann at redhat.com>
    - 1.6.0-1

    - Update to 1.6.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in rdesktop, a Remote Desktop Protocol client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1801     Remote exploitation of an integer underflow     vulnerability allows attackers to execute arbitrary code     with the privileges of the logged-in user.

  - CVE-2008-1802     Remote exploitation of a BSS overflow vulnerability     allows attackers to execute arbitrary code with the     privileges of the logged-in user.

  - CVE-2008-1803     Remote exploitation of an integer signedness     vulnerability allows attackers to execute arbitrary code     with the privileges of the logged-in user.

ID	Name	Product	Family	Severity
38000	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : rdesktop vulnerabilities (USN-646-1)	Nessus	Ubuntu Local Security Checks	high
37563	Mandriva Linux Security Advisory : rdesktop (MDVSA-2008:101)	Nessus	Mandriva Local Security Checks	high
33898	openSUSE 10 Security Update : rdesktop (rdesktop-5271)	Nessus	SuSE Local Security Checks	high
33889	SuSE 10 Security Update : rdesktop (ZYPP Patch Number 5272)	Nessus	SuSE Local Security Checks	high
33189	GLSA-200806-04 : rdesktop: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
32349	Fedora 7 : rdesktop-1.6.0-1.fc7 (2008-3985)	Nessus	Fedora Local Security Checks	high
32343	Fedora 8 : rdesktop-1.6.0-1.fc8 (2008-3917)	Nessus	Fedora Local Security Checks	high
32338	Fedora 9 : rdesktop-1.6.0-1.fc9 (2008-3886)	Nessus	Fedora Local Security Checks	high
32307	Debian DSA-1573-1 : rdesktop - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-1802

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high