CVE-2019-20373 - LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an

CVE-2019-20373

Summary

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

References

Vulnerable Configurations

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ltsp:ldm:2.18.06:*:*:*:*:*:*:*
cpe:2.3:a:ltsp:ldm:2.18.06:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 24-01-2020 - 15:11)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

debian	DSA-4601
misc	https://git.launchpad.net/~ltsp-upstream/ltsp/+git/ldm/commit/?id=c351ac69ef63ed6c84221cef73e409059661b8ba
mlist	[debian-lts-announce] 20200110 [SECURITY] [DLA 2064-1] ldm security update

Last major update

24-01-2020 - 15:11

Published

09-01-2020 - 23:15

Last modified

24-01-2020 - 15:11