Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.

A malicious server could access any file on clients connecting to it if the client shared some ressource (CVE-2011-1595).

From Red Hat Security Advisory 2011:0506 :

An updated rdesktop package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

rdesktop is a client for the Remote Desktop Server (previously, Terminal Server) in Microsoft Windows. It uses the Remote Desktop Protocol (RDP) to remotely present a user's desktop.

A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local files accessible to the user running rdesktop. (CVE-2011-1595)

Red Hat would like to thank Cendio AB for reporting this issue. Cendio AB acknowledges an anonymous contributor working with the SecuriTeam Secure Disclosure program as the original reporter.

Users of rdesktop should upgrade to this updated package, which contains a backported patch to resolve this issue.

The remote host is affected by the vulnerability described in GLSA-201210-03 (rdesktop: Directory Traversal)

    A vulnerability has been discovered in rdesktop. Please review the CVE       identifier referenced below for details.
  Impact :

    Remote RDP servers may be able to read or overwrite arbitrary files via       a .. (dot dot) in a pathname.
  Workaround :

    There is no known workaround at this time.

A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local files accessible to the user running rdesktop. (CVE-2011-1595)

The following bug has been fixed :

  - A malicious server could access any file on clients     connecting to it if the client shared some ressource.
    (CVE-2011-1595)

It was discovered that rdesktop incorrectly handled specially crafted paths when using disk redirection. If a user were tricked into connecting to a malicious server, an attacker could access arbitrary files on the user's filesystem.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a security issue in rdesktop 1.6.0.

A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local files accessible to the user running rdesktop. (CVE-2011-1595)

Fedora would like to thank Cendio AB for reporting this issue. Cendio AB acknowledges an anonymous contributor working with the SecuriTeam Secure Disclosure program as the original reporter.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been identified and fixed in rdesktop :

Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname (CVE-2011-1595).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:0506 advisory.

    rdesktop is a client for the Remote Desktop Server (previously, Terminal     Server) in Microsoft Windows. It uses the Remote Desktop Protocol (RDP) to     remotely present a user's desktop.

    A directory traversal flaw was found in the way rdesktop shared a local     path with a remote server. If a user connects to a malicious server with     rdesktop, the server could use this flaw to cause rdesktop to read and     write to arbitrary, local files accessible to the user running rdesktop.
    (CVE-2011-1595)

    Red Hat would like to thank Cendio AB for reporting this issue. Cendio AB     acknowledges an anonymous contributor working with the SecuriTeam Secure     Disclosure program as the original reporter.

    Users of rdesktop should upgrade to this updated package, which contains a     backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated rdesktop package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

rdesktop is a client for the Remote Desktop Server (previously, Terminal Server) in Microsoft Windows. It uses the Remote Desktop Protocol (RDP) to remotely present a user's desktop.

A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local files accessible to the user running rdesktop. (CVE-2011-1595)

Red Hat would like to thank Cendio AB for reporting this issue. Cendio AB acknowledges an anonymous contributor working with the SecuriTeam Secure Disclosure program as the original reporter.

Users of rdesktop should upgrade to this updated package, which contains a backported patch to resolve this issue.

New rdesktop packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

ID	Name	Product	Family	Severity
76009	openSUSE Security Update : rdesktop (openSUSE-SU-2011:0528-1)	Nessus	SuSE Local Security Checks	medium
75725	openSUSE Security Update : rdesktop (openSUSE-SU-2011:0530-1)	Nessus	SuSE Local Security Checks	medium
68274	Oracle Linux 5 / 6 : rdesktop (ELSA-2011-0506)	Nessus	Oracle Linux Local Security Checks	medium
62633	GLSA-201210-03 : rdesktop: Directory Traversal	Nessus	Gentoo Local Security Checks	medium
61037	Scientific Linux Security Update : rdesktop on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57252	SuSE 10 Security Update : rdesktop (ZYPP Patch Number 7525)	Nessus	SuSE Local Security Checks	medium
55097	Ubuntu 10.04 LTS / 10.10 / 11.04 : rdesktop vulnerability (USN-1136-1)	Nessus	Ubuntu Local Security Checks	medium
55005	Fedora 14 : rdesktop-1.6.0-11.fc14 (2011-7697)	Nessus	Fedora Local Security Checks	medium
55004	Fedora 13 : rdesktop-1.6.0-10.fc13 (2011-7694)	Nessus	Fedora Local Security Checks	medium
54963	Fedora 15 : rdesktop-1.6.0-12.fc15 (2011-7688)	Nessus	Fedora Local Security Checks	medium
54918	Mandriva Linux Security Advisory : rdesktop (MDVSA-2011:102)	Nessus	Mandriva Local Security Checks	medium
54642	SuSE 11.1 Security Update : rdesktop (SAT Patch Number 4547)	Nessus	SuSE Local Security Checks	medium
53873	RHEL 5 / 6 : rdesktop (RHSA-2011:0506)	Nessus	Red Hat Local Security Checks	critical
53871	CentOS 5 : rdesktop (CESA-2011:0506)	Nessus	CentOS Local Security Checks	medium
53515	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : rdesktop (SSA:2011-110-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2011-1595

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium