[ASA-201902-5] rdesktop: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201902-5
=========================================

Severity: High
Date    : 2019-02-11
CVE-ID  : CVE-2018-8791  CVE-2018-8792  CVE-2018-8793  CVE-2018-8794
          CVE-2018-8795  CVE-2018-8796  CVE-2018-8797  CVE-2018-8798
          CVE-2018-8799  CVE-2018-8800  CVE-2018-20174 CVE-2018-20175
          CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179
          CVE-2018-20180 CVE-2018-20181 CVE-2018-20182
Package : rdesktop
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-871

Summary
=======

The package rdesktop before version 1.8.4-1 is vulnerable to multiple
issues including arbitrary code execution, denial of service and
information disclosure.

Resolution
==========

Upgrade to 1.8.4-1.

# pacman -Syu "rdesktop>=1.8.4-1"

The problems have been fixed upstream in version 1.8.4.

Workaround
==========

None.

Description
===========

- CVE-2018-8791 (information disclosure)

rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function rdpdr_process() that results in an information leak.

- CVE-2018-8792 (denial of service)

rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function cssp_read_tsrequest() that results in a denial of service
(segfault).

- CVE-2018-8793 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function cssp_read_tsrequest() that results in a memory corruption and
probably even a remote code execution.

- CVE-2018-8794 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to an integer overflow that leads
to an out-of-bounds write in function process_bitmap_updates() and
results in a memory corruption and possibly even a remote code
execution.

- CVE-2018-8795 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to an integer overflow that leads
to a heap-based buffer overflow in function process_bitmap_updates()
and results in a memory corruption and probably even a remote code
execution.

- CVE-2018-8796 (denial of service)

rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function process_bitmap_updates() that results in a denial of service
(segfault).

- CVE-2018-8797 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function process_plane() that results in a memory corruption and
probably even a remote code execution.

- CVE-2018-8798 (information disclosure)

rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function rdpsnd_process_ping() that results in an information leak.

- CVE-2018-8799 (denial of service)

rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function process_secondary_order() that results in a denial of service
(segfault).

- CVE-2018-8800 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function ui_clip_handle_data() that results in a memory corruption and
probably even a remote code execution.

- CVE-2018-20174 (information disclosure)

rdesktop before 1.8.4 is vulnerable to an information leak in
ui_clip_handle_data().

- CVE-2018-20175 (denial of service)

rdesktop before 1.8.4 is vulnerable to denial of service in
mcs_recv_connect_response() and mcs_parse_domain_params().

- CVE-2018-20176 (denial of service)

rdesktop before 1.8.4 is vulnerable to denial of service in
sec_parse_crypt_info() and sec_recv().

- CVE-2018-20177 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to a memory corruption issue in
rdp_in_unistr() that could lead to arbitrary code execution.

- CVE-2018-20178 (denial of service)

rdesktop before 1.8.4 is vulnerable to denial of service in
process_demand_active().

- CVE-2018-20179 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to remote code execution in
lspci_process().

- CVE-2018-20180 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to remote code execution in
rdpsnddbg_process().

- CVE-2018-20181 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to remote code execution in
seamless_process().

- CVE-2018-20182 (arbitrary code execution)

rdesktop before 1.8.4 is vulnerable to remote code execution in
seamless_process_line().

Impact
======

A remote attacker is able to execute arbitrary code, access sensitive
information or crash rdesktop when the client connects to a malicious
server in control of the attacker.

References
==========

https://bugs.archlinux.org/task/61652
https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
https://security.archlinux.org/CVE-2018-8791
https://security.archlinux.org/CVE-2018-8792
https://security.archlinux.org/CVE-2018-8793
https://security.archlinux.org/CVE-2018-8794
https://security.archlinux.org/CVE-2018-8795
https://security.archlinux.org/CVE-2018-8796
https://security.archlinux.org/CVE-2018-8797
https://security.archlinux.org/CVE-2018-8798
https://security.archlinux.org/CVE-2018-8799
https://security.archlinux.org/CVE-2018-8800
https://security.archlinux.org/CVE-2018-20174
https://security.archlinux.org/CVE-2018-20175
https://security.archlinux.org/CVE-2018-20176
https://security.archlinux.org/CVE-2018-20177
https://security.archlinux.org/CVE-2018-20178
https://security.archlinux.org/CVE-2018-20179
https://security.archlinux.org/CVE-2018-20180
https://security.archlinux.org/CVE-2018-20181
https://security.archlinux.org/CVE-2018-20182

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190212/c5e9e5cd/attachment.sig>