SB2019012928 - Fedora 28 update for rdesktop
Published: January 29, 2019 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2018-8794)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow condition in the process_bitmap_updates() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger out-of-bounds write and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Heap-based buffer overflow (CVE-ID: CVE-2018-8795)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an integer overflow. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger out-of-bounds write condition in the process_bitmap_updates() function and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Heap-based buffer overflow (CVE-ID: CVE-2018-8797)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a heap-based buffer overflow condition in the process_plane() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Out-of-bounds read (CVE-ID: CVE-2018-20175)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).
5) Out-of-bounds read (CVE-ID: CVE-2018-20176)
The vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary condition when processing RDP packets in sec_parse_crypt_info() and sec_recv() functionsin secure.cfile. A remote attacker can trick the victim that is using the vulnerable RDP client to connect to malicious RDP server, trigger out-of-bounds read error and perform denial of service attack.
6) Out-of-bounds read (CVE-ID: CVE-2018-8791)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to an out-of-bounds read condition in the rdpdr_process() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and access sensitive information on the targeted system.
7) Out-of-bounds read (CVE-ID: CVE-2018-8792)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an out-of-bounds read condition in the cssp_read_tsrequest() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and cause the service to crash.
8) Heap-based buffer overflow (CVE-ID: CVE-2018-8793)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a heap-based buffer overflow condition in the cssp_read_tsrequest() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Out-of-bounds read (CVE-ID: CVE-2018-8796)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an out-of-bounds read condition in the process_bitmap_updates() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and cause the service to crash.
10) Out-of-bounds read (CVE-ID: CVE-2018-8798)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to an out-of-bounds read condition in the rdpsnd_process_ping()function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and access sensitive information on the targeted system.
11) Out-of-bounds read (CVE-ID: CVE-2018-8799)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an out-of-bounds read condition in the process_secondary_order() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger segmentation fault (segfault) and cause the service to crash.
12) Heap-based buffer overflow (CVE-ID: CVE-2018-8800)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a heap-based buffer overflow condition in the ui_clip_handle_data() function. A remote attacker can trick the victim who is using a Remote Desktop Protocol (RDP) client on a targeted system into connecting to an attacker-controlled RDP server, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
13) Out-of-bounds read (CVE-ID: CVE-2018-20174)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary error in the function ui_clip_handle_data(). A remote attacker can send a specially crafted request to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
14) Integer overflow (CVE-ID: CVE-2018-20177)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in function rdp_in_unistr(). A remote attacker can send a crafted request to the affected application, trigger memory corruption and possibly even a remote code execution.
15) Out-of-bounds read (CVE-ID: CVE-2018-20178)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).
16) Integer underflow (CVE-ID: CVE-2018-20179)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.
17) Integer underflow (CVE-ID: CVE-2018-20180)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.
18) Integer overflow (CVE-ID: CVE-2018-20181)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.
19) Buffer overflow (CVE-ID: CVE-2018-20182)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.
Remediation
Install update from vendor's website.