CVE-2011-1595 — Path Traversal in Rdesktop

CWE-22 — Path Traversal8 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 44.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RdesktopDebian Rdesktop
Timeline
PublishedMay 24
Latest updateMay 17

Description

Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.

CVSS vector

AV:A/AC:H/C:P/I:P/A:PExploitability: 3.2 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/rdesktop< rdesktop 1.7.0-1 (bookworm)
▶Debianrdesktop/rdesktop< 1.7.0-1+3
▶NVDrdesktop/rdesktop1.6.0+8

Patches

Patch: rdesktop.svn.sourceforge.net ↗Patch: sourceforge.net ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x8vw-2wrg-9c52: Directory traversal vulnerability in the disk_create function in disk↗2022-05-17
▶
OSV
CVE-2011-1595: Directory traversal vulnerability in the disk_create function in disk↗2011-05-24
▶

📋Vendor Advisories

3
Ubuntu
rdesktop vulnerability↗2011-05-25
▶
Red Hat
rdesktop remote file access↗2011-04-18
▶
Debian
CVE-2011-1595: rdesktop - Directory traversal vulnerability in the disk_create function in disk.c in rdesk...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-1595 rdesktop remote file access [fedora-all]↗2011-04-20
▶
Bugzilla
CVE-2011-1595 rdesktop remote file access↗2011-02-09
▶