Detections
Analytics
Scientific Linux Security Update : rdesktop on SL4.x i386/x86_64
high Nessus Plugin ID 60384
Language:
Synopsis
The remote Scientific Linux host is missing a security update.Description
An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)Additionally, the following bug was fixed :
A missing command line option caused rdesktop to fail when using the krdc remote desktop utility. Using krdc to connect to a terminal server resulted in errors such as the following :
The version of rdesktop you are using ([version]) is too old :
rdesktop [version] or greater is required. A working patch for rdesktop [version] can be found in KDE CVS.
In this updated package, krdc successfully connects to terminal servers.
Solution
Update the affected rdesktop package.See Also
Plugin Details
Severity: High
ID: 60384
File Name: sl_20080416_rdesktop_on_SL4_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 8/1/2012
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 4/16/2008
Reference Information
CVE: CVE-2008-1801
CWE: 189