« Volver al listado

CVE-2018-8788

Estado: ModificadaCrítica (9.8)—

FreeRDP en versiones anteriores a la 2.0.0-rc4 contiene una escritura fuera de límites de hasta 4 bytes en la función nsc_rle_decode() que resulta en una corrupción de memoria y, probablemente, incluso en la ejecución remota de código.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Canonical — Ubuntu LinuxDebian — Debian LinuxFreerdp — Freerdp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8788",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "Check Point Software Technologies Ltd.",
          "product": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 2.0.0-rc4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-29T18:29:00.990",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106938",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:0697",
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://github.com/FreeRDP/FreeRDP/commit/d1112c279bd1a327e8e4d0b5f371458bf2579659",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00015.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://usn.ubuntu.com/3845-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://usn.ubuntu.com/3845-2/",
      "source": "cve@checkpoint.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/106938",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:0697",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/FreeRDP/FreeRDP/commit/d1112c279bd1a327e8e4d0b5f371458bf2579659",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00015.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/3845-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/3845-2/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@checkpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution."
    },
    {
      "lang": "es",
      "value": "FreeRDP en versiones anteriores a la 2.0.0-rc4 contiene una escritura fuera de límites de hasta 4 bytes en la función nsc_rle_decode() que resulta en una corrupción de memoria y, probablemente, incluso en la ejecución remota de código."
    }
  ],
  "lastModified": "2026-06-17T02:05:23.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB13905B-B0E9-443E-B150-9D64E20DC464",
              "versionEndIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:2.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F226993C-3AB8-4F86-8591-40CAAC8DD73E"
            },
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:2.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "985D90BF-3B2B-4A3C-B698-DBCB0241B95B"
            },
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:2.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C4656D2-EEC4-4871-BA0F-76F760526B1B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com"
}