PT-2017-17681 · Canonical+1 · Lightdm+2

G. Geshev + 1 · Published 2017-04-04 · Updated 2019-05-23 · CVE-2017-7358

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LightDM versions prior to 1.23.0, specifically versions through 1.22.0

Description A directory traversal issue exists in the debian/guest-account.sh script of LightDM, allowing local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.

Recommendations For versions through 1.22.0, update to version 1.23.0 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2019-1877

ALT-PU-2019-1900

CVE-2017-7358

USN-3255-1

Affected Products

Alt Linux

Lightdm

Ubuntu

References · 17

• 🔥 https://exploit-db.com/exploits/41923 · Exploit
• https://errata.altlinux.org/ALT-PU-2019-1900 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3255-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7358 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7358 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1877 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3255-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7358 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7358 · Vendor Advisory
• https://ubuntu.com/usn/usn-3255-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7358 · Security Note
• https://ubuntu.com/security/CVE-2017-7358 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2017-7358 · Note
• https://lists.freedesktop.org/archives/lightdm/2017-April/001059.html · Note
• http://securityfocus.com/bid/97486 · Note