{"id": "FEDORA:BBF466087A79", "type": "fedora", "bulletinFamily": "unix", "title": "[SECURITY] Fedora 29 Update: rdesktop-1.8.4-2.fc29", "description": "rdesktop is an open source client for Windows NT Terminal Server and Windows 2000 & 2003 Terminal Services, capable of natively speaking Remote Desktop Protocol (RDP) in order to present the user's NT desktop. Unlike Citrix ICA, no server extensions are required. ", "published": "2019-02-13T02:48:16", "modified": "2019-02-13T02:48:16", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "", "reporter": "Fedora", "references": [], "cvelist": ["CVE-2018-20174", "CVE-2018-20175", "CVE-2018-20176", "CVE-2018-20177", "CVE-2018-20178", "CVE-2018-20179", "CVE-2018-20180", "CVE-2018-20181", "CVE-2018-20182", "CVE-2018-8791", "CVE-2018-8792", "CVE-2018-8793", "CVE-2018-8794", "CVE-2018-8795", "CVE-2018-8796", "CVE-2018-8797", "CVE-2018-8798", "CVE-2018-8799", "CVE-2018-8800"], "lastseen": "2020-12-21T08:17:55", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "suse", "idList": ["OPENSUSE-SU-2019:2135-1"]}, {"type": "gentoo", "idList": ["GLSA-201903-06"]}, {"type": "freebsd", "idList": ["3E2C9B63-223C-4575-AF5C-816ACB14E445"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310891683", "OPENVAS:1361412562310852889", "OPENVAS:1361412562310875456", "OPENVAS:1361412562310113358", "OPENVAS:1361412562310876770", "OPENVAS:1361412562310875827", "OPENVAS:1361412562310704394"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-201903-06.NASL", "DEBIAN_DLA-1683.NASL", "DEBIAN_DSA-4394.NASL", "FEDORA_2019-5146CD34E2.NASL", "FREEBSD_PKG_3E2C9B63223C4575AF5C816ACB14E445.NASL", "OPENSUSE-2019-2135.NASL"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1683-1:7CEE2", "DEBIAN:DSA-4394-1:6FB8A"]}, {"type": "archlinux", "idList": ["ASA-201902-5"]}, {"type": "fedora", "idList": ["FEDORA:D8B10606DF52", "FEDORA:66406608E6C5"]}, {"type": "cve", "idList": ["CVE-2018-20180", "CVE-2018-20174", "CVE-2018-20175", "CVE-2018-20182", "CVE-2018-8792", "CVE-2018-20177", "CVE-2018-20179", "CVE-2018-20178", "CVE-2018-20181", "CVE-2018-20176"]}], "modified": "2020-12-21T08:17:55", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2020-12-21T08:17:55", "rev": 2}, "vulnersScore": 5.4}, "affectedPackage": [{"OS": "Fedora", "OSVersion": "29", "arch": "any", "packageName": "rdesktop", "packageVersion": "1.8.4", "packageFilename": "UNKNOWN", "operator": "lt"}]}

{"fedora": [{"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-20174", "CVE-2018-20175", "CVE-2018-20176", "CVE-2018-20177", "CVE-2018-20178", "CVE-2018-20179", "CVE-2018-20180", "CVE-2018-20181", "CVE-2018-20182", "CVE-2018-8791", "CVE-2018-8792", "CVE-2018-8793", "CVE-2018-8794", "CVE-2018-8795", "CVE-2018-8796", "CVE-2018-8797", "CVE-2018-8798", "CVE-2018-8799", "CVE-2018-8800"], "description": "rdesktop is an open source client for Windows NT Terminal Server and Windows 2000 & 2003 Terminal Services, capable of natively speaking Remote Desktop Protocol (RDP) in order to present the user's NT desktop. Unlike Citrix ICA, no server extensions are required. ", "modified": "2019-02-13T06:15:03", "published": "2019-02-13T06:15:03", "id": "FEDORA:66406608E6C5", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: rdesktop-1.8.4-2.fc28", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-20174", "CVE-2018-20175", "CVE-2018-20176", "CVE-2018-20177", "CVE-2018-20178", "CVE-2018-20179", "CVE-2018-20180", "CVE-2018-20181", "CVE-2018-20182", "CVE-2018-8791", "CVE-2018-8792", "CVE-2018-8793", "CVE-2018-8794", "CVE-2018-8795", "CVE-2018-8796", "CVE-2018-8797", "CVE-2018-8798", "CVE-2018-8799", "CVE-2018-8800"], "description": "rdesktop is an open source client for Windows NT Terminal Server and Windows 2000 & 2003 Terminal Services, capable of natively speaking Remote Desktop Protocol (RDP) in order to present the user's NT desktop. Unlike Citrix ICA, no server extensions are required. ", "modified": "2019-09-06T12:59:50", "published": "2019-09-06T12:59:50", "id": "FEDORA:D8B10606DF52", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: rdesktop-1.8.6-1.fc29", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-01-01T02:23:26", "description": "Update to 1.8.4. Security fix for CVE-2018-8794 CVE-2018-8795\nCVE-2018-8797 CVE-2018-20175 CVE-2018-20176 CVE-2018-8791\nCVE-2018-8792 CVE-2018-8793 CVE-2018-8796 CVE-2018-8798 CVE-2018-8799\nCVE-2018-8800 CVE-2018-20174 CVE-2018-20177 CVE-2018-20178\nCVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 19, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-02-13T00:00:00", "title": "Fedora 28 : rdesktop (2019-5146cd34e2)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:rdesktop", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2019-5146CD34E2.NASL", "href": "https://www.tenable.com/plugins/nessus/122134", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-5146cd34e2.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(122134);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/02/12\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_xref(name:\"FEDORA\", value:\"2019-5146cd34e2\");\n\n script_name(english:\"Fedora 28 : rdesktop (2019-5146cd34e2)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to 1.8.4. Security fix for CVE-2018-8794 CVE-2018-8795\nCVE-2018-8797 CVE-2018-20175 CVE-2018-20176 CVE-2018-8791\nCVE-2018-8792 CVE-2018-8793 CVE-2018-8796 CVE-2018-8798 CVE-2018-8799\nCVE-2018-8800 CVE-2018-20174 CVE-2018-20177 CVE-2018-20178\nCVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-5146cd34e2\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected rdesktop package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/02/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"rdesktop-1.8.4-2.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rdesktop\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T01:50:00", "description": "Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.", "edition": 19, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-02-19T00:00:00", "title": "Debian DSA-4394-1 : rdesktop - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:rdesktop", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4394.NASL", "href": "https://www.tenable.com/plugins/nessus/122271", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4394. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(122271);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/02/13\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_xref(name:\"DSA\", value:\"4394\");\n\n script_name(english:\"Debian DSA-4394-1 : rdesktop - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/rdesktop\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/rdesktop\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2019/dsa-4394\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the rdesktop packages.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 1.8.4-1~deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/02/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"rdesktop\", reference:\"1.8.4-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T02:56:48", "description": "The remote host is affected by the vulnerability described in GLSA-201903-06\n(rdesktop: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in rdesktop. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could cause a Denial of Service condition, obtain\n sensitive information, or execute arbitrary code.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 17, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-03-11T00:00:00", "title": "GLSA-201903-06 : rdesktop: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:rdesktop"], "id": "GENTOO_GLSA-201903-06.NASL", "href": "https://www.tenable.com/plugins/nessus/122734", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201903-06.\n#\n# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(122734);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2020/02/05\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_xref(name:\"GLSA\", value:\"201903-06\");\n\n script_name(english:\"GLSA-201903-06 : rdesktop: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201903-06\n(rdesktop: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in rdesktop. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could cause a Denial of Service condition, obtain\n sensitive information, or execute arbitrary code.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201903-06\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All rdesktop users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/rdesktop-1.8.4'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/rdesktop\", unaffected:make_list(\"ge 1.8.4\"), vulnerable:make_list(\"lt 1.8.4\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rdesktop\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T04:19:26", "description": "This update for rdesktop fixes the following issues :\n\nrdesktop was updated to 1.8.6 :\n\n - Fix protocol code handling new licenses\n\nrdesktop was updated to 1.8.5 :\n\n - Add bounds checking to protocol handling in order to fix\n many security problems when communicating with a\n malicious server.\n\nrdesktop was updated to 1.8.4 (fix for boo#1121448) :\n\n - Add rdp_protocol_error function that is used in several\n fixes\n\n - Refactor of process_bitmap_updates\n\n - Fix possible integer overflow in s_check_rem() on 32bit\n arch\n\n - Fix memory corruption in process_bitmap_data -\n CVE-2018-8794\n\n - Fix remote code execution in process_bitmap_data -\n CVE-2018-8795\n\n - Fix remote code execution in process_plane -\n CVE-2018-8797\n\n - Fix Denial of Service in mcs_recv_connect_response -\n CVE-2018-20175\n\n - Fix Denial of Service in mcs_parse_domain_params -\n CVE-2018-20175\n\n - Fix Denial of Service in sec_parse_crypt_info -\n CVE-2018-20176\n\n - Fix Denial of Service in sec_recv - CVE-2018-20176\n\n - Fix minor information leak in rdpdr_process -\n CVE-2018-8791\n\n - Fix Denial of Service in cssp_read_tsrequest -\n CVE-2018-8792\n\n - Fix remote code execution in cssp_read_tsrequest -\n CVE-2018-8793\n\n - Fix Denial of Service in process_bitmap_data -\n CVE-2018-8796\n\n - Fix minor information leak in rdpsnd_process_ping -\n CVE-2018-8798\n\n - Fix Denial of Service in process_secondary_order -\n CVE-2018-8799\n\n - Fix remote code execution in in ui_clip_handle_data -\n CVE-2018-8800\n\n - Fix major information leak in ui_clip_handle_data -\n CVE-2018-20174\n\n - Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n - Fix Denial of Service in process_demand_active -\n CVE-2018-20178\n\n - Fix remote code execution in lspci_process -\n CVE-2018-20179\n\n - Fix remote code execution in rdpsnddbg_process -\n CVE-2018-20180\n\n - Fix remote code execution in seamless_process -\n CVE-2018-20181\n\n - Fix remote code execution in seamless_process_line -\n CVE-2018-20182\n\n - Fix building against OpenSSL 1.1\n\n - remove obsolete patches\n\n - rdesktop-Fix-OpenSSL-1.1-compability-issues.patch\n\n - rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch\n\n - update changes file\n\n - add missing info about bugzilla 1121448\n\n - Added rdesktop-Fix-decryption.patch Patch from\n https://github.com/rdesktop/rdesktop/pull/334 to fix\n connections to VirtualBox.\n\n - update to 1.8.6\n\n - Fix protocol code handling new licenses\n\n - update to 1.8.5\n\n - Add bounds checking to protocol handling in order to fix\n many security problems when communicating with a\n malicious server.\n\n - Trim redundant wording from description.\n\n - Use %make_install.\n\n - update to 1.8.4 (fix for boo#1121448)\n\n - Add rdp_protocol_error function that is used in several\n fixes\n\n - Refactor of process_bitmap_updates\n\n - Fix possible integer overflow in s_check_rem() on 32bit\n arch\n\n - Fix memory corruption in process_bitmap_data -\n CVE-2018-8794\n\n - Fix remote code execution in process_bitmap_data -\n CVE-2018-8795\n\n - Fix remote code execution in process_plane -\n CVE-2018-8797\n\n - Fix Denial of Service in mcs_recv_connect_response -\n CVE-2018-20175\n\n - Fix Denial of Service in mcs_parse_domain_params -\n CVE-2018-20175\n\n - Fix Denial of Service in sec_parse_crypt_info -\n CVE-2018-20176\n\n - Fix Denial of Service in sec_recv - CVE-2018-20176\n\n - Fix minor information leak in rdpdr_process -\n CVE-2018-8791\n\n - Fix Denial of Service in cssp_read_tsrequest -\n CVE-2018-8792\n\n - Fix remote code execution in cssp_read_tsrequest -\n CVE-2018-8793\n\n - Fix Denial of Service in process_bitmap_data -\n CVE-2018-8796\n\n - Fix minor information leak in rdpsnd_process_ping -\n CVE-2018-8798\n\n - Fix Denial of Service in process_secondary_order -\n CVE-2018-8799\n\n - Fix remote code execution in in ui_clip_handle_data -\n CVE-2018-8800\n\n - Fix major information leak in ui_clip_handle_data -\n CVE-2018-20174\n\n - Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n - Fix Denial of Service in process_demand_active -\n CVE-2018-20178\n\n - Fix remote code execution in lspci_process -\n CVE-2018-20179\n\n - Fix remote code execution in rdpsnddbg_process -\n CVE-2018-20180\n\n - Fix remote code execution in seamless_process -\n CVE-2018-20181\n\n - Fix remote code execution in seamless_process_line -\n CVE-2018-20182\n\n - Fix building against OpenSSL 1.1", "edition": 17, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-16T00:00:00", "title": "openSUSE Security Update : rdesktop (openSUSE-2019-2135)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:rdesktop", "cpe:/o:novell:opensuse:15.1", "p-cpe:/a:novell:opensuse:rdesktop-debugsource", "p-cpe:/a:novell:opensuse:rdesktop-debuginfo"], "id": "OPENSUSE-2019-2135.NASL", "href": "https://www.tenable.com/plugins/nessus/128866", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-2135.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128866);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/12/27\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n\n script_name(english:\"openSUSE Security Update : rdesktop (openSUSE-2019-2135)\");\n script_summary(english:\"Check for the openSUSE-2019-2135 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for rdesktop fixes the following issues :\n\nrdesktop was updated to 1.8.6 :\n\n - Fix protocol code handling new licenses\n\nrdesktop was updated to 1.8.5 :\n\n - Add bounds checking to protocol handling in order to fix\n many security problems when communicating with a\n malicious server.\n\nrdesktop was updated to 1.8.4 (fix for boo#1121448) :\n\n - Add rdp_protocol_error function that is used in several\n fixes\n\n - Refactor of process_bitmap_updates\n\n - Fix possible integer overflow in s_check_rem() on 32bit\n arch\n\n - Fix memory corruption in process_bitmap_data -\n CVE-2018-8794\n\n - Fix remote code execution in process_bitmap_data -\n CVE-2018-8795\n\n - Fix remote code execution in process_plane -\n CVE-2018-8797\n\n - Fix Denial of Service in mcs_recv_connect_response -\n CVE-2018-20175\n\n - Fix Denial of Service in mcs_parse_domain_params -\n CVE-2018-20175\n\n - Fix Denial of Service in sec_parse_crypt_info -\n CVE-2018-20176\n\n - Fix Denial of Service in sec_recv - CVE-2018-20176\n\n - Fix minor information leak in rdpdr_process -\n CVE-2018-8791\n\n - Fix Denial of Service in cssp_read_tsrequest -\n CVE-2018-8792\n\n - Fix remote code execution in cssp_read_tsrequest -\n CVE-2018-8793\n\n - Fix Denial of Service in process_bitmap_data -\n CVE-2018-8796\n\n - Fix minor information leak in rdpsnd_process_ping -\n CVE-2018-8798\n\n - Fix Denial of Service in process_secondary_order -\n CVE-2018-8799\n\n - Fix remote code execution in in ui_clip_handle_data -\n CVE-2018-8800\n\n - Fix major information leak in ui_clip_handle_data -\n CVE-2018-20174\n\n - Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n - Fix Denial of Service in process_demand_active -\n CVE-2018-20178\n\n - Fix remote code execution in lspci_process -\n CVE-2018-20179\n\n - Fix remote code execution in rdpsnddbg_process -\n CVE-2018-20180\n\n - Fix remote code execution in seamless_process -\n CVE-2018-20181\n\n - Fix remote code execution in seamless_process_line -\n CVE-2018-20182\n\n - Fix building against OpenSSL 1.1\n\n - remove obsolete patches\n\n - rdesktop-Fix-OpenSSL-1.1-compability-issues.patch\n\n - rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch\n\n - update changes file\n\n - add missing info about bugzilla 1121448\n\n - Added rdesktop-Fix-decryption.patch Patch from\n https://github.com/rdesktop/rdesktop/pull/334 to fix\n connections to VirtualBox.\n\n - update to 1.8.6\n\n - Fix protocol code handling new licenses\n\n - update to 1.8.5\n\n - Add bounds checking to protocol handling in order to fix\n many security problems when communicating with a\n malicious server.\n\n - Trim redundant wording from description.\n\n - Use %make_install.\n\n - update to 1.8.4 (fix for boo#1121448)\n\n - Add rdp_protocol_error function that is used in several\n fixes\n\n - Refactor of process_bitmap_updates\n\n - Fix possible integer overflow in s_check_rem() on 32bit\n arch\n\n - Fix memory corruption in process_bitmap_data -\n CVE-2018-8794\n\n - Fix remote code execution in process_bitmap_data -\n CVE-2018-8795\n\n - Fix remote code execution in process_plane -\n CVE-2018-8797\n\n - Fix Denial of Service in mcs_recv_connect_response -\n CVE-2018-20175\n\n - Fix Denial of Service in mcs_parse_domain_params -\n CVE-2018-20175\n\n - Fix Denial of Service in sec_parse_crypt_info -\n CVE-2018-20176\n\n - Fix Denial of Service in sec_recv - CVE-2018-20176\n\n - Fix minor information leak in rdpdr_process -\n CVE-2018-8791\n\n - Fix Denial of Service in cssp_read_tsrequest -\n CVE-2018-8792\n\n - Fix remote code execution in cssp_read_tsrequest -\n CVE-2018-8793\n\n - Fix Denial of Service in process_bitmap_data -\n CVE-2018-8796\n\n - Fix minor information leak in rdpsnd_process_ping -\n CVE-2018-8798\n\n - Fix Denial of Service in process_secondary_order -\n CVE-2018-8799\n\n - Fix remote code execution in in ui_clip_handle_data -\n CVE-2018-8800\n\n - Fix major information leak in ui_clip_handle_data -\n CVE-2018-20174\n\n - Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n - Fix Denial of Service in process_demand_active -\n CVE-2018-20178\n\n - Fix remote code execution in lspci_process -\n CVE-2018-20179\n\n - Fix remote code execution in rdpsnddbg_process -\n CVE-2018-20180\n\n - Fix remote code execution in seamless_process -\n CVE-2018-20181\n\n - Fix remote code execution in seamless_process_line -\n CVE-2018-20182\n\n - Fix building against OpenSSL 1.1\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1121448\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/rdesktop/rdesktop/pull/334\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected rdesktop packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rdesktop-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rdesktop-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"rdesktop-1.8.6-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"rdesktop-debuginfo-1.8.6-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"rdesktop-debugsource-1.8.6-lp151.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rdesktop / rdesktop-debuginfo / rdesktop-debugsource\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T02:37:33", "description": "- Fix memory corruption in process_bitmap_data - CVE-2018-8794\n\n- Fix remote code execution in process_bitmap_data - CVE-2018-8795\n\n- Fix remote code execution in process_plane - CVE-2018-8797\n\n- Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n\n- Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n\n- Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n\n- Fix Denial of Service in sec_recv - CVE-2018-20176\n\n- Fix minor information leak in rdpdr_process - CVE-2018-8791\n\n- Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n\n- Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n\n- Fix Denial of Service in process_bitmap_data - CVE-2018-8796\n\n- Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n\n- Fix Denial of Service in process_secondary_order - CVE-2018-8799\n\n- Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n\n- Fix major information leak in ui_clip_handle_data - CVE-2018-20174\n\n- Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n- Fix Denial of Service in process_demand_active - CVE-2018-20178\n\n- Fix remote code execution in lspci_process - CVE-2018-20179\n\n- Fix remote code execution in rdpsnddbg_process - CVE-2018-20180\n\n- Fix remote code execution in seamless_process - CVE-2018-20181\n\n- Fix remote code execution in seamless_process_line - CVE-2018-20182", "edition": 17, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-02-25T00:00:00", "title": "FreeBSD : rdesktop - critical - Remote Code Execution (3e2c9b63-223c-4575-af5c-816acb14e445)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:rdesktop"], "id": "FREEBSD_PKG_3E2C9B63223C4575AF5C816ACB14E445.NASL", "href": "https://www.tenable.com/plugins/nessus/122412", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2020 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(122412);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/02/07\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n\n script_name(english:\"FreeBSD : rdesktop - critical - Remote Code Execution (3e2c9b63-223c-4575-af5c-816acb14e445)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"- Fix memory corruption in process_bitmap_data - CVE-2018-8794\n\n- Fix remote code execution in process_bitmap_data - CVE-2018-8795\n\n- Fix remote code execution in process_plane - CVE-2018-8797\n\n- Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n\n- Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n\n- Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n\n- Fix Denial of Service in sec_recv - CVE-2018-20176\n\n- Fix minor information leak in rdpdr_process - CVE-2018-8791\n\n- Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n\n- Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n\n- Fix Denial of Service in process_bitmap_data - CVE-2018-8796\n\n- Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n\n- Fix Denial of Service in process_secondary_order - CVE-2018-8799\n\n- Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n\n- Fix major information leak in ui_clip_handle_data - CVE-2018-20174\n\n- Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n- Fix Denial of Service in process_demand_active - CVE-2018-20178\n\n- Fix remote code execution in lspci_process - CVE-2018-20179\n\n- Fix remote code execution in rdpsnddbg_process - CVE-2018-20180\n\n- Fix remote code execution in seamless_process - CVE-2018-20181\n\n- Fix remote code execution in seamless_process_line - CVE-2018-20182\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4\"\n );\n # https://vuxml.freebsd.org/freebsd/3e2c9b63-223c-4575-af5c-816acb14e445.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?db0e2c57\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"rdesktop<1.8.4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-12T09:40:21", "description": "Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n1.8.4-0+deb8u1.\n\nWe recommend that you upgrade your rdesktop packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.", "edition": 17, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-02-20T00:00:00", "title": "Debian DLA-1683-1 : rdesktop security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "modified": "2019-02-20T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:rdesktop", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-1683.NASL", "href": "https://www.tenable.com/plugins/nessus/122318", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1683-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(122318);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n\n script_name(english:\"Debian DLA-1683-1 : rdesktop security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n1.8.4-0+deb8u1.\n\nWe recommend that you upgrade your rdesktop packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/rdesktop\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected rdesktop package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:rdesktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"rdesktop\", reference:\"1.8.4-0+deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2019-03-11T01:51:29", "bulletinFamily": "unix", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "### Background\n\nrdesktop is a Remote Desktop Protocol (RDP) Client.\n\n### Description\n\nMultiple vulnerabilities have been discovered in rdesktop. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could cause a Denial of Service condition, obtain sensitive information, or execute arbitrary code. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll rdesktop users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/rdesktop-1.8.4\"", "edition": 1, "modified": "2019-03-10T00:00:00", "published": "2019-03-10T00:00:00", "id": "GLSA-201903-06", "href": "https://security.gentoo.org/glsa/201903-06", "title": "rdesktop: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2019-05-29T18:32:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "The remote host is missing an update for the ", "modified": "2019-05-14T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310875827", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875827", "type": "openvas", "title": "Fedora Update for rdesktop FEDORA-2019-ac70292cfc", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875827\");\n script_version(\"2019-05-14T05:04:40+0000\");\n script_cve_id(\"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8797\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8796\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\", \"CVE-2018-20174\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-05-14 05:04:40 +0000 (Tue, 14 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:22:22 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for rdesktop FEDORA-2019-ac70292cfc\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-ac70292cfc\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44K6LSAXB2JLUNLQSISCQPFXSKENUAW5\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rdesktop'\n package(s) announced via the FEDORA-2019-ac70292cfc advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"rdesktop is an open source client for Windows NT Terminal Server and\nWindows 2000 & 2003 Terminal Services, capable of natively speaking\nRemote Desktop Protocol (RDP) in order to present the user&#39, s NT\ndesktop. Unlike Citrix ICA, no server extensions are required.\");\n\n script_tag(name:\"affected\", value:\"'rdesktop' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"rdesktop\", rpm:\"rdesktop~1.8.4~2.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-04T18:46:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.", "modified": "2019-07-04T00:00:00", "published": "2019-02-18T00:00:00", "id": "OPENVAS:1361412562310704394", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704394", "type": "openvas", "title": "Debian Security Advisory DSA 4394-1 (rdesktop - security update)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704394\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\",\n \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\",\n \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\",\n \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_name(\"Debian Security Advisory DSA 4394-1 (rdesktop - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-02-18 00:00:00 +0100 (Mon, 18 Feb 2019)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4394.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"rdesktop on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), these problems have been fixed in\nversion 1.8.4-1~deb9u1.\n\nWe recommend that you upgrade your rdesktop packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/rdesktop\");\n script_tag(name:\"summary\", value:\"Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"rdesktop\", ver:\"1.8.4-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:19", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "The remote host is missing an update for the\n ", "modified": "2019-03-19T00:00:00", "published": "2019-02-14T00:00:00", "id": "OPENVAS:1361412562310875456", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875456", "type": "openvas", "title": "Fedora Update for rdesktop FEDORA-2019-5146cd34e2", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875456\");\n script_version(\"$Revision: 14300 $\");\n script_cve_id(\"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8797\", \"CVE-2018-20175\",\n \"CVE-2018-20176\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\",\n \"CVE-2018-8796\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\",\n \"CVE-2018-20174\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\",\n \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 08:52:26 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2019-02-14 04:08:04 +0100 (Thu, 14 Feb 2019)\");\n script_name(\"Fedora Update for rdesktop FEDORA-2019-5146cd34e2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-5146cd34e2\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPNEOV2ZX56MI4RNCZJCFJWNP6HTTFYB\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the\n 'rdesktop' package(s) announced via the FEDORA-2019-5146cd34e2 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is\n present on the target host.\");\n\n script_tag(name:\"affected\", value:\"rdesktop on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"rdesktop\", rpm:\"rdesktop~1.8.4~2.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-31T16:27:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2020-01-09T00:00:00", "id": "OPENVAS:1361412562310852889", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852889", "type": "openvas", "title": "openSUSE: Security Advisory for rdesktop (openSUSE-SU-2019:2135-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852889\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\",\n \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\",\n \"CVE-2018-20182\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\",\n \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\", \"CVE-2018-8797\",\n \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 09:41:30 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"openSUSE: Security Advisory for rdesktop (openSUSE-SU-2019:2135-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:2135-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rdesktop'\n package(s) announced via the openSUSE-SU-2019:2135-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for rdesktop fixes the following issues:\n\n rdesktop was updated to 1.8.6:\n\n * Fix protocol code handling new licenses\n\n rdesktop was updated to 1.8.5:\n\n * Add bounds checking to protocol handling in order to fix many security\n problems when communicating with a malicious server.\n\n rdesktop was updated to 1.8.4 (fix for boo#1121448):\n\n * Add rdp_protocol_error function that is used in several fixes\n\n * Refactor of process_bitmap_updates\n\n * Fix possible integer overflow in s_check_rem() on 32bit arch\n\n * Fix memory corruption in process_bitmap_data - CVE-2018-8794\n\n * Fix remote code execution in process_bitmap_data - CVE-2018-8795\n\n * Fix remote code execution in process_plane - CVE-2018-8797\n\n * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n\n * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n\n * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n\n * Fix Denial of Service in sec_recv - CVE-2018-20176\n\n * Fix minor information leak in rdpdr_process - CVE-2018-8791\n\n * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n\n * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n\n * Fix Denial of Service in process_bitmap_data - CVE-2018-8796\n\n * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n\n * Fix Denial of Service in process_secondary_order - CVE-2018-8799\n\n * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n\n * Fix major information leak in ui_clip_handle_data - CVE-2018-20174\n\n * Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n\n * Fix Denial of Service in process_demand_active - CVE-2018-20178\n\n * Fix remote code execution in lspci_process - CVE-2018-20179\n\n * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180\n\n * Fix remote code execution in seamless_process - CVE-2018-20181\n\n * Fix remote code execution in seamless_process_line - CVE-2018-20182\n\n * Fix building against OpenSSL 1.1\n\n - remove obsolete patches\n\n * rdesktop-Fix-OpenSSL-1.1-compability-issues.patch\n\n * rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch\n\n - update changes file\n\n * add missing info about bugzilla 1121448\n\n - update to 1.8.6\n\n * Fix protocol code handling new licenses\n\n - update to 1.8.5\n\n * Add bounds checking to protocol handling in order to fix many security\n problems when communicating with a malicious server.\n\n - Trim redundant wording from descrip ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'rdesktop' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"rdesktop\", rpm:\"rdesktop~1.8.6~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"rdesktop-debuginfo\", rpm:\"rdesktop-debuginfo~1.8.6~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"rdesktop-debugsource\", rpm:\"rdesktop-debugsource~1.8.6~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-29T19:29:58", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.", "modified": "2020-01-29T00:00:00", "published": "2019-02-19T00:00:00", "id": "OPENVAS:1361412562310891683", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891683", "type": "openvas", "title": "Debian LTS: Security Advisory for rdesktop (DLA-1683-1)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891683\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\",\n \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\", \"CVE-2018-8791\",\n \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8796\",\n \"CVE-2018-8797\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\");\n script_name(\"Debian LTS: Security Advisory for rdesktop (DLA-1683-1)\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-02-19 00:00:00 +0100 (Tue, 19 Feb 2019)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_tag(name:\"affected\", value:\"rdesktop on Debian Linux\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n1.8.4-0+deb8u1.\n\nWe recommend that you upgrade your rdesktop packages.\");\n\n script_tag(name:\"summary\", value:\"Multiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\");\n\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"rdesktop\", ver:\"1.8.4-0+deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-09-10T14:46:39", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "The remote host is missing an update for the ", "modified": "2019-09-10T00:00:00", "published": "2019-09-07T00:00:00", "id": "OPENVAS:1361412562310876770", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876770", "type": "openvas", "title": "Fedora Update for rdesktop FEDORA-2019-a457303ffc", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876770\");\n script_version(\"2019-09-10T08:05:24+0000\");\n script_cve_id(\"CVE-2018-8794\", \"CVE-2018-8795\", \"CVE-2018-8797\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-8791\", \"CVE-2018-8792\", \"CVE-2018-8793\", \"CVE-2018-8796\", \"CVE-2018-8798\", \"CVE-2018-8799\", \"CVE-2018-8800\", \"CVE-2018-20174\", \"CVE-2018-20177\", \"CVE-2018-20178\", \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-09-10 08:05:24 +0000 (Tue, 10 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-07 02:24:09 +0000 (Sat, 07 Sep 2019)\");\n script_name(\"Fedora Update for rdesktop FEDORA-2019-a457303ffc\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-a457303ffc\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONGZBK5UUMOP7K2DAI3RHIKEO5Z3EAUC\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rdesktop'\n package(s) announced via the FEDORA-2019-a457303ffc advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"rdesktop is an open source client for Windows NT Terminal Server and\nWindows 2000 & 2003 Terminal Services, capable of natively speaking\nRemote Desktop Protocol (RDP) in order to present the user&#39, s NT\ndesktop. Unlike Citrix ICA, no server extensions are required.\");\n\n script_tag(name:\"affected\", value:\"'rdesktop' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"rdesktop\", rpm:\"rdesktop~1.8.6~1.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-10-09T14:28:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-20181", "CVE-2018-20174", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178"], "description": "rdesktop is prone to multiple vulnerabilities.", "modified": "2019-10-07T00:00:00", "published": "2019-03-20T00:00:00", "id": "OPENVAS:1361412562310113358", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310113358", "type": "openvas", "title": "rdesktop <= 1.8.3 Multiple Vulnerabilities", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.113358\");\n script_version(\"2019-10-07T14:34:48+0000\");\n script_tag(name:\"last_modification\", value:\"2019-10-07 14:34:48 +0000 (Mon, 07 Oct 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-03-20 14:31:01 +0100 (Wed, 20 Mar 2019)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_tag(name:\"qod_type\", value:\"executable_version_unreliable\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_cve_id(\"CVE-2018-20174\", \"CVE-2018-20175\", \"CVE-2018-20176\", \"CVE-2018-20177\", \"CVE-2018-20178\",\n \"CVE-2018-20179\", \"CVE-2018-20180\", \"CVE-2018-20181\", \"CVE-2018-20182\");\n script_bugtraq_id(106938);\n\n script_name(\"rdesktop <= 1.8.3 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_rdesktop_detect_lin.nasl\");\n script_mandatory_keys(\"rdesktop/detected\");\n\n script_tag(name:\"summary\", value:\"rdesktop is prone to multiple vulnerabilities.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The following vulnerabilities exist:\n\n - Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak\n\n - several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c\n and result in a Denial of Service (segfault)\n\n - several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault)\n\n - Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr()\n and results in memory corruption and possibly even a remote code execution\n\n - Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault)\n\n - Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process()\n and results in memory corruption and probably even a remote code execution\n\n - Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process()\n and results in memory corruption and probably even a remote code execution\n\n - Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process()\n and results in memory corruption and probably even a remote code execution\n\n - Buffer Overflow over the global variables in the function seamless_process_line()\n that results in memory corruption and probably even a remote code execution\");\n script_tag(name:\"affected\", value:\"rdesktop through version 1.8.3.\");\n script_tag(name:\"solution\", value:\"Update to version 1.8.4.\");\n\n script_xref(name:\"URL\", value:\"https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/\");\n\n exit(0);\n}\n\nCPE = \"cpe:/a:rdesktop:rdesktop\";\n\ninclude( \"host_details.inc\" );\ninclude( \"version_func.inc\" );\n\nif( ! infos = get_app_version_and_location( cpe: CPE, exit_no_version: TRUE ) ) exit( 0 );\nversion = infos[\"version\"];\nlocation = infos[\"location\"];\n\nif( version_is_less( version: version, test_version: \"1.8.4\" ) ) {\n report = report_fixed_ver( installed_version: version, fixed_version: \"1.8.4\", install_path: location );\n security_message( data: report, port: 0 );\n exit( 0 );\n}\n\nexit( 99 );\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:22:47", "bulletinFamily": "unix", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "Package : rdesktop\nVersion : 1.8.4-0+deb8u1\nCVE ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794\n CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798\n CVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175\n CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179\n CVE-2018-20180 CVE-2018-20181 CVE-2018-20182\n\nMultiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n1.8.4-0+deb8u1.\n\nWe recommend that you upgrade your rdesktop packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 2, "modified": "2019-02-19T10:40:01", "published": "2019-02-19T10:40:01", "id": "DEBIAN:DLA-1683-1:7CEE2", "href": "https://lists.debian.org/debian-lts-announce/2019/debian-lts-announce-201902/msg00030.html", "title": "[SECURITY] [DLA 1683-1] rdesktop security update", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-30T02:21:21", "bulletinFamily": "unix", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4394-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nFebruary 18, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : rdesktop\nCVE ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794 \n CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798 \n CVE-2018-8799 CVE-2018-8800 CVE-2018-20174\n\t\t CVE-2018-20175 CVE-2018-20176 CVE-2018-20177\n\t\t CVE-2018-20178 CVE-2018-20179 CVE-2018-20180\n\t\t CVE-2018-20181 CVE-2018-20182\n\nMultiple security issues were found in the rdesktop RDP client, which\ncould result in denial of service, information disclosure and the\nexecution of arbitrary code.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1.8.4-1~deb9u1.\n\nWe recommend that you upgrade your rdesktop packages.\n\nFor the detailed security status of rdesktop please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/rdesktop\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 2, "modified": "2019-02-18T21:24:40", "published": "2019-02-18T21:24:40", "id": "DEBIAN:DSA-4394-1:6FB8A", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2019/msg00035.html", "title": "[SECURITY] [DSA 4394-1] rdesktop security update", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2019-09-15T02:41:32", "bulletinFamily": "unix", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "This update for rdesktop fixes the following issues:\n\n rdesktop was updated to 1.8.6:\n\n * Fix protocol code handling new licenses\n\n rdesktop was updated to 1.8.5:\n\n * Add bounds checking to protocol handling in order to fix many security\n problems when communicating with a malicious server.\n\n rdesktop was updated to 1.8.4 (fix for boo#1121448):\n\n * Add rdp_protocol_error function that is used in several fixes\n * Refactor of process_bitmap_updates\n * Fix possible integer overflow in s_check_rem() on 32bit arch\n * Fix memory corruption in process_bitmap_data - CVE-2018-8794\n * Fix remote code execution in process_bitmap_data - CVE-2018-8795\n * Fix remote code execution in process_plane - CVE-2018-8797\n * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n * Fix Denial of Service in sec_recv - CVE-2018-20176\n * Fix minor information leak in rdpdr_process - CVE-2018-8791\n * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n * Fix Denial of Service in process_bitmap_data - CVE-2018-8796\n * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n * Fix Denial of Service in process_secondary_order - CVE-2018-8799\n * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n * Fix major information leak in ui_clip_handle_data - CVE-2018-20174\n * Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n * Fix Denial of Service in process_demand_active - CVE-2018-20178\n * Fix remote code execution in lspci_process - CVE-2018-20179\n * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180\n * Fix remote code execution in seamless_process - CVE-2018-20181\n * Fix remote code execution in seamless_process_line - CVE-2018-20182\n * Fix building against OpenSSL 1.1\n - remove obsolete patches\n * rdesktop-Fix-OpenSSL-1.1-compability-issues.patch\n * rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch\n\n - update changes file\n * add missing info about bugzilla 1121448\n\n - Added rdesktop-Fix-decryption.patch Patch from\n <a rel=\"nofollow\" href=\"https://github.com/rdesktop/rdesktop/pull/334\">https://github.com/rdesktop/rdesktop/pull/334</a> to fix connections to\n VirtualBox.\n\n - update to 1.8.6\n * Fix protocol code handling new licenses\n\n - update to 1.8.5\n * Add bounds checking to protocol handling in order to fix many security\n problems when communicating with a malicious server.\n\n - Trim redundant wording from description.\n - Use %make_install.\n\n - update to 1.8.4 (fix for boo#1121448)\n * Add rdp_protocol_error function that is used in several fixes\n * Refactor of process_bitmap_updates\n * Fix possible integer overflow in s_check_rem() on 32bit arch\n * Fix memory corruption in process_bitmap_data - CVE-2018-8794\n * Fix remote code execution in process_bitmap_data - CVE-2018-8795\n * Fix remote code execution in process_plane - CVE-2018-8797\n * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n * Fix Denial of Service in sec_recv - CVE-2018-20176\n * Fix minor information leak in rdpdr_process - CVE-2018-8791\n * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n * Fix Denial of Service in process_bitmap_data - CVE-2018-8796\n * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n * Fix Denial of Service in process_secondary_order - CVE-2018-8799\n * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n * Fix major information leak in ui_clip_handle_data - CVE-2018-20174\n * Fix memory corruption in rdp_in_unistr - CVE-2018-20177\n * Fix Denial of Service in process_demand_active - CVE-2018-20178\n * Fix remote code execution in lspci_process - CVE-2018-20179\n * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180\n * Fix remote code execution in seamless_process - CVE-2018-20181\n * Fix remote code execution in seamless_process_line - CVE-2018-20182\n * Fix building against OpenSSL 1.1\n\n", "edition": 1, "modified": "2019-09-15T00:10:30", "published": "2019-09-15T00:10:30", "id": "OPENSUSE-SU-2019:2135-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html", "title": "Security update for rdesktop (important)", "type": "suse", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:31:46", "bulletinFamily": "unix", "cvelist": ["CVE-2018-8792", "CVE-2018-8798", "CVE-2018-8793", "CVE-2018-8795", "CVE-2018-20181", "CVE-2018-8794", "CVE-2018-8797", "CVE-2018-8800", "CVE-2018-20174", "CVE-2018-8799", "CVE-2018-20182", "CVE-2018-20176", "CVE-2018-20175", "CVE-2018-8791", "CVE-2018-20179", "CVE-2018-20177", "CVE-2018-20180", "CVE-2018-20178", "CVE-2018-8796"], "description": "\n\n\nFix memory corruption in process_bitmap_data - CVE-2018-8794\n\t \nFix remote code execution in process_bitmap_data - CVE-2018-8795\n\t \nFix remote code execution in process_plane - CVE-2018-8797\n\t \nFix Denial of Service in mcs_recv_connect_response - CVE-2018-20175\n\t \nFix Denial of Service in mcs_parse_domain_params - CVE-2018-20175\n\t \nFix Denial of Service in sec_parse_crypt_info - CVE-2018-20176\n\t \nFix Denial of Service in sec_recv - CVE-2018-20176\n\t \nFix minor information leak in rdpdr_process - CVE-2018-8791\n\t \nFix Denial of Service in cssp_read_tsrequest - CVE-2018-8792\n\t \nFix remote code execution in cssp_read_tsrequest - CVE-2018-8793\n\t \nFix Denial of Service in process_bitmap_data - CVE-2018-8796\n\t \nFix minor information leak in rdpsnd_process_ping - CVE-2018-8798\n\t \nFix Denial of Service in process_secondary_order - CVE-2018-8799\n\t \nFix remote code execution in in ui_clip_handle_data - CVE-2018-8800\n\t \nFix major information leak in ui_clip_handle_data - CVE-2018-20174\n\t \nFix memory corruption in rdp_in_unistr - CVE-2018-20177\n\t \nFix Denial of Service in process_demand_active - CVE-2018-20178\n\t \nFix remote code execution in lspci_process - CVE-2018-20179\n\t \nFix remote code execution in rdpsnddbg_process - CVE-2018-20180\n\t \nFix remote code execution in seamless_process - CVE-2018-20181\n\t \nFix remote code execution in seamless_process_line - CVE-2018-20182\n\t \n\n\n", "edition": 2, "modified": "2019-01-02T00:00:00", "published": "2019-01-02T00:00:00", "id": "3E2C9B63-223C-4575-AF5C-816ACB14E445", "href": "https://vuxml.freebsd.org/freebsd/3e2c9b63-223c-4575-af5c-816acb14e445.html", "title": "rdesktop - critical - Remote Code Execution", "type": "freebsd", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:40", "bulletinFamily": "unix", "cvelist": ["CVE-2018-20174", "CVE-2018-20175", "CVE-2018-20176", "CVE-2018-20177", "CVE-2018-20178", "CVE-2018-20179", "CVE-2018-20180", "CVE-2018-20181", "CVE-2018-20182", "CVE-2018-8791", "CVE-2018-8792", "CVE-2018-8793", "CVE-2018-8794", "CVE-2018-8795", "CVE-2018-8796", "CVE-2018-8797", "CVE-2018-8798", "CVE-2018-8799", "CVE-2018-8800"], "description": "Arch Linux Security Advisory ASA-201902-5\n=========================================\n\nSeverity: High\nDate : 2019-02-11\nCVE-ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794\nCVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798\nCVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175\nCVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179\nCVE-2018-20180 CVE-2018-20181 CVE-2018-20182\nPackage : rdesktop\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-871\n\nSummary\n=======\n\nThe package rdesktop before version 1.8.4-1 is vulnerable to multiple\nissues including arbitrary code execution, denial of service and\ninformation disclosure.\n\nResolution\n==========\n\nUpgrade to 1.8.4-1.\n\n# pacman -Syu \"rdesktop>=1.8.4-1\"\n\nThe problems have been fixed upstream in version 1.8.4.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2018-8791 (information disclosure)\n\nrdesktop before 1.8.4 is vulnerable to an out-of-bounds read in\nfunction rdpdr_process() that results in an information leak.\n\n- CVE-2018-8792 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to an out-of-bounds read in\nfunction cssp_read_tsrequest() that results in a denial of service\n(segfault).\n\n- CVE-2018-8793 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in\nfunction cssp_read_tsrequest() that results in a memory corruption and\nprobably even a remote code execution.\n\n- CVE-2018-8794 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to an integer overflow that leads\nto an out-of-bounds write in function process_bitmap_updates() and\nresults in a memory corruption and possibly even a remote code\nexecution.\n\n- CVE-2018-8795 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to an integer overflow that leads\nto a heap-based buffer overflow in function process_bitmap_updates()\nand results in a memory corruption and probably even a remote code\nexecution.\n\n- CVE-2018-8796 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to an out-of-bounds read in\nfunction process_bitmap_updates() that results in a denial of service\n(segfault).\n\n- CVE-2018-8797 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in\nfunction process_plane() that results in a memory corruption and\nprobably even a remote code execution.\n\n- CVE-2018-8798 (information disclosure)\n\nrdesktop before 1.8.4 is vulnerable to an out-of-bounds read in\nfunction rdpsnd_process_ping() that results in an information leak.\n\n- CVE-2018-8799 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to an out-of-bounds read in\nfunction process_secondary_order() that results in a denial of service\n(segfault).\n\n- CVE-2018-8800 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in\nfunction ui_clip_handle_data() that results in a memory corruption and\nprobably even a remote code execution.\n\n- CVE-2018-20174 (information disclosure)\n\nrdesktop before 1.8.4 is vulnerable to an information leak in\nui_clip_handle_data().\n\n- CVE-2018-20175 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to denial of service in\nmcs_recv_connect_response() and mcs_parse_domain_params().\n\n- CVE-2018-20176 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to denial of service in\nsec_parse_crypt_info() and sec_recv().\n\n- CVE-2018-20177 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to a memory corruption issue in\nrdp_in_unistr() that could lead to arbitrary code execution.\n\n- CVE-2018-20178 (denial of service)\n\nrdesktop before 1.8.4 is vulnerable to denial of service in\nprocess_demand_active().\n\n- CVE-2018-20179 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to remote code execution in\nlspci_process().\n\n- CVE-2018-20180 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to remote code execution in\nrdpsnddbg_process().\n\n- CVE-2018-20181 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to remote code execution in\nseamless_process().\n\n- CVE-2018-20182 (arbitrary code execution)\n\nrdesktop before 1.8.4 is vulnerable to remote code execution in\nseamless_process_line().\n\nImpact\n======\n\nA remote attacker is able to execute arbitrary code, access sensitive\ninformation or crash rdesktop when the client connects to a malicious\nserver in control of the attacker.\n\nReferences\n==========\n\nhttps://bugs.archlinux.org/task/61652\nhttps://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1\nhttps://security.archlinux.org/CVE-2018-8791\nhttps://security.archlinux.org/CVE-2018-8792\nhttps://security.archlinux.org/CVE-2018-8793\nhttps://security.archlinux.org/CVE-2018-8794\nhttps://security.archlinux.org/CVE-2018-8795\nhttps://security.archlinux.org/CVE-2018-8796\nhttps://security.archlinux.org/CVE-2018-8797\nhttps://security.archlinux.org/CVE-2018-8798\nhttps://security.archlinux.org/CVE-2018-8799\nhttps://security.archlinux.org/CVE-2018-8800\nhttps://security.archlinux.org/CVE-2018-20174\nhttps://security.archlinux.org/CVE-2018-20175\nhttps://security.archlinux.org/CVE-2018-20176\nhttps://security.archlinux.org/CVE-2018-20177\nhttps://security.archlinux.org/CVE-2018-20178\nhttps://security.archlinux.org/CVE-2018-20179\nhttps://security.archlinux.org/CVE-2018-20180\nhttps://security.archlinux.org/CVE-2018-20181\nhttps://security.archlinux.org/CVE-2018-20182", "modified": "2019-02-11T00:00:00", "published": "2019-02-11T00:00:00", "id": "ASA-201902-5", "href": "https://security.archlinux.org/ASA-201902-5", "type": "archlinux", "title": "[ASA-201902-5] rdesktop: multiple issues", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.", "edition": 7, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20177", "type": "cve", "cwe": ["CWE-190", "CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20177"], "modified": "2020-08-24T17:37:00", "cpe": ["cpe:/a:rdesktop:rdesktop:1.8.3"], "id": "CVE-2018-20177", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20177", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20178", "type": "cve", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20178"], "modified": "2019-09-15T00:15:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-20178", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20178", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20182", "type": "cve", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20182"], "modified": "2019-09-15T00:15:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-20182", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20182", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.", "edition": 7, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20181", "type": "cve", "cwe": ["CWE-787", "CWE-191"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20181"], "modified": "2020-08-24T17:37:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-20181", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20181", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20174", "type": "cve", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20174"], "modified": "2019-03-21T16:00:00", "cpe": ["cpe:/a:rdesktop:rdesktop:1.8.3"], "id": "CVE-2018-20174", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20174", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20180", "type": "cve", "cwe": ["CWE-191"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20180"], "modified": "2019-09-15T00:15:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-20180", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20180", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20179", "type": "cve", "cwe": ["CWE-191"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20179"], "modified": "2019-03-21T16:00:00", "cpe": ["cpe:/a:rdesktop:rdesktop:1.8.3"], "id": "CVE-2018-20179", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20179", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20175", "type": "cve", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20175"], "modified": "2019-09-15T00:15:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-20175", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20175", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:40", "description": "rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-03-15T18:29:00", "title": "CVE-2018-20176", "type": "cve", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20176"], "modified": "2019-03-21T16:00:00", "cpe": ["cpe:/a:rdesktop:rdesktop:1.8.3"], "id": "CVE-2018-20176", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20176", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:25:47", "description": "rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution.", "edition": 7, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-02-05T20:29:00", "title": "CVE-2018-8795", "type": "cve", "cwe": ["CWE-190", "CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-8795"], "modified": "2020-09-29T01:09:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/o:opensuse:leap:15.1", "cpe:/a:rdesktop:rdesktop:1.8.3", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2018-8795", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-8795", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe:2.3:a:rdesktop:rdesktop:1.8.3:*:*:*:*:*:*:*"]}]}