PT-2008-6902 · Linux Terminal Server+1 · Ldm+4

Nico Golde · Published 1970-01-01 · Updated 2018-10-03 · CVE-2008-1293

Positive Technologies (AI Summary)

CVSS v2.0

4.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ltsp-server-standalone versions (affected versions not specified) ltsp-server versions (affected versions not specified) ltsp-client-builder versions (affected versions not specified) ltsp-client versions (affected versions not specified) ldm versions 0.99 and 2

Description The issue concerns multiple vulnerabilities in the ltsp-server-standalone, ltsp-server, ltsp-client-builder, ltsp-client, and ldm packages of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by an attacker to compromise the confidentiality and integrity of protected information. In the case of ldm in Linux Terminal Server Project (LTSP), it passes the -ac option to the X server on each LTSP client, allowing remote attackers to connect to this server via TCP port 6006, also known as display :6.

Recommendations For ltsp-server-standalone, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ltsp-server, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ltsp-client-builder, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ltsp-client, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ldm versions 0.99 and 2, consider restricting access to the X server on each LTSP client to minimize the risk of exploitation.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-01994

BDU:2015-01995

BDU:2015-01996

BDU:2015-01997

BDU:2015-01998

CVE-2008-1293

DSA-1561-1

DTSA-118-1

Affected Products

Ldm

Ltsp-Client

Ltsp-Client-Builder

Ltsp-Server

Ltsp-Server-Standalone

References · 21

• https://bdu.fstec.ru/vul/2015-01998 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1293 · Security Note
• http://debian.org/security/2008/dsa-1561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01996 · Security Note
• https://bdu.fstec.ru/vul/2015-01995 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1293 · Vendor Advisory
• http://secunia.com/advisories/29959 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01997 · Security Note
• http://secunia.com/advisories/30099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1293 · Security Note
• https://bdu.fstec.ru/vul/2015-01994 · Security Note
• https://usn.ubuntu.com/610-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1293 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1293 · Vendor Advisory
• http://securitytracker.com/id?1019940 · Note