CVE-2011-1595: Path Traversal
Directory traversal vulnerability in the diskcreate function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.
Other sources
Hi, we (Cendio) have been shared information about a security vulnerability and have verified it in code that this is possible.
We don't have time to investigate further nor producing a patch and want some help on that point.
Report:
"The vulnerability is a Directory Traversal vulnerability which affects an rDesktop client (I believe other products that use the same code will have the same issue), which will allow someone connecting to a compromised server (RDP server) or via a MITM vulnerability to access any file he desires on the user's computer.
The vulnerability allows writing, reading and listing the content of the directories, all transparently.
The vulnerability requires the user to share "something" on his end (rDesktop end), and from that point when he connects to the compromised server, the server will have full access to his computer - of course depending on what permissions he has - those are the areas of the computer he can reach."
Regards. Henrik Andersson (Cendio AB) henrik.andersson
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1595?
CVE-2011-1595 is classified as a high severity vulnerability due to its ability to allow remote file access and manipulation.
How do I fix CVE-2011-1595?
To fix CVE-2011-1595, upgrade rdesktop to version 1.7.0 or later where the vulnerability is resolved.
What impact does CVE-2011-1595 have on affected systems?
CVE-2011-1595 allows remote RDP servers to read or overwrite arbitrary files, which can lead to data exposure or loss.
Which versions of rdesktop are affected by CVE-2011-1595?
CVE-2011-1595 affects rdesktop versions prior to 1.7.0, including versions 1.0.0 through 1.6.0.
What is the nature of CVE-2011-1595?
CVE-2011-1595 is a directory traversal vulnerability that exploits improper input validation in the disk_create function.