Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8792: rdesktop may crash when processing remote desktop requests

CVE-2018-8792 · published 7 years ago

Summary

Versions of rdesktop up to 1.8.3 on Debian Linux contain a coding error that can cause the program to stop working when it receives certain remote‑desktop messages. This can interrupt remote desktop sessions and require a restart of the client. Upgrade rdesktop to a newer version or apply available patches to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
rdesktop	rdesktop	<= 1.8.3 `cpe:2.3:a:rdesktop:rdesktop::::::::`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault).

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html
http://www.securityfocus.com/bid/106938 Third Party Advisory VDB Entry
https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b... Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html Mailing List Third Party Advisory
https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients... Third Party Advisory
https://security.gentoo.org/glsa/201903-06 Third Party Advisory
https://www.debian.org/security/2019/dsa-4394 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

4% chance of attack within 30 days

Type

CWE-126Buffer Over-read

CWE-125Out-of-bounds Read

Timeline

Published5 Feb 2019

Updated24 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-8792 · NVD

Track software like this

Free during beta