LTSP Display Manager could be made to escalate user privileges.. =========================================================================Ubuntu Security Notice USN-4533-1 September 22, 2020 ldm vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: LTSP Display Manager could be made to escalate user privileges. Software Description: - ldm: LTSP display manager Details: Veeti Veteläinen discovered that the LTSP Display Manager (ldm) incorrectly handled user logins from unsupported shells. A local attacker could possibly use this issue to gain root privileges. (CVE-2019-20373) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: ldm 2:2.18.06-1+deb10u1build0.20.04.1 ldm-server 2:2.18.06-1+deb10u1build0.20.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4533-1 https://bugs.launchpad.net/ltsp/+bug/1839431 Package Information: https://launchpad.net/ubuntu/+source/ldm/2:2.18.06-1+deb10u1build0.20.04.1 . Fedora Security Advisory FSA-2023-456 addresses critical ldm flaws affecting user access levels. Ensure your system is protected.. LTSP Display Manager, Privileges Escalation, Ubuntu Security, Local Attacker. . Severity: Critical. LinuxSecurity.com Team
It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project incorrectly parsed responses from an SSH server which could result in local root privilege escalation. . Package : ldm Version : 2:2.2.15-2+deb8u1 CVE ID : CVE-2019-20373 Debian Bug : #948538 It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project incorrectly parsed responses from an SSH server which could result in local root privilege escalation. For Debian 8 "Jessie", this issue has been fixed in ldm version 2:2.2.15-2+deb8u1. We recommend that you upgrade your ldm packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Regards, - -- ,'`. : :' : Chris Lamb `. `'`
It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project incorrectly parsed responses from an SSH server which could result in local root privilege escalation. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4601-1
LTSP Display Manager could be made to run programs as an administrator.. =========================================================================Ubuntu Security Notice USN-1398-1 March 12, 2012 ldm vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 Summary: LTSP Display Manager could be made to run programs as an administrator. Software Description: - ldm: LTSP display manager Details: Tenho Tuhkala discovered that the LTSP Display Manager (ldm) incorrectly filtered keybindings. An attacker could use the default keybindings to execute arbitrary commands as root at the login screen. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: ldm 2:2.2.4-0ubuntu1.1 Ubuntu 11.04: ldm 2:2.2.1-0ubuntu1.1 After a standard system update you need to restart the LTSP Display Manager to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1398-1 CVE-2012-1166 Package Information: https://launchpad.net/ubuntu/+source/ldm/2:2.2.4-0ubuntu1.1 https://launchpad.net/ubuntu/+source/ldm/2:2.2.1-0ubuntu1.1 . LTSP Display Manager on Ubuntu identified with vulnerabilities that could permit unauthorized administrative access. Immediate updates suggested.. LTSP Display Manager, Ubuntu Security Notice, administrative access risk. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.