CVE-2018-8797
rdesktop: Remote code execution in process_plane
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | rdesktop | 1.8.6-r0 |
| alpine 3.11 | rdesktop | 1.8.6-r0 |
| alpine 3.12 | rdesktop | 1.8.6-r0 |
| alpine 3.13 | rdesktop | 1.8.6-r0 |
| alpine 3.14 | rdesktop | 1.8.6-r0 |
| alpine 3.15 | rdesktop | 1.8.6-r0 |
| alpine 3.16 | rdesktop | 1.8.6-r0 |
| alpine 3.17 | rdesktop | 1.8.6-r0 |
| alpine 3.18 | rdesktop | 1.8.6-r0 |
| alpine 3.19 | rdesktop | 1.8.6-r0 |
| alpine 3.20 | rdesktop | 1.8.6-r0 |
| alpine 3.21 | rdesktop | 1.8.6-r0 |
Mostrar las 25 entradas de 25 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | rdesktop | 1.8.6-r0 |
| alpine 3.11 | rdesktop | 1.8.6-r0 |
| alpine 3.12 | rdesktop | 1.8.6-r0 |
| alpine 3.13 | rdesktop | 1.8.6-r0 |
| alpine 3.14 | rdesktop | 1.8.6-r0 |
| alpine 3.15 | rdesktop | 1.8.6-r0 |
| alpine 3.16 | rdesktop | 1.8.6-r0 |
| alpine 3.17 | rdesktop | 1.8.6-r0 |
| alpine 3.18 | rdesktop | 1.8.6-r0 |
| alpine 3.19 | rdesktop | 1.8.6-r0 |
| alpine 3.20 | rdesktop | 1.8.6-r0 |
| alpine 3.21 | rdesktop | 1.8.6-r0 |
| alpine 3.22 | rdesktop | 1.8.6-r0 |
| alpine 3.23 | rdesktop | 1.8.6-r0 |
| alpine 3.24 | rdesktop | 1.8.6-r0 |
| alpine edge | rdesktop | 1.8.6-r0 |
| debian 11 | rdesktop | 1.8.4-1 |
| debian 12 | rdesktop | 1.8.4-1 |
| debian 13 | rdesktop | 1.8.4-1 |
| debian 14 | rdesktop | 1.8.4-1 |
| debian 8 | rdesktop | 1.8.4-0+deb8u1 |
| debian 9 | rdesktop | 1.8.4-1~deb9u1 |
| echo | rdesktop | 1.8.4-1 |
| Red Hat | rdesktop | sin corrección indicada |
| ubuntu 18.04-ESM | rdesktop | sin corrección indicada |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html
- http://www.securityfocus.com/bid/106938
- https://access.redhat.com/security/cve/CVE-2018-8797
- https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
- https://github.com/rdesktop/rdesktop/commit/766ebcf6f23ccfe8323ac10242ae6e127d4505d2%20%28v1.8.4%29
- https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8797
- https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/