Executive Summary
| Summary | |
|---|---|
| Title | LTSP vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-610-1 | First vendor Publication | 2008-05-06 |
| Vendor | Ubuntu | Last vendor Modification | 2008-05-06 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.8 | Attack Range | Adjacent network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 6.5 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 7.04: Ubuntu 7.10: After a standard system upgrade you need to update your LTSP client chroots to effect the necessary changes. For more details, please see: http://doc.ubuntu.com/edubuntu/edubuntu/handbook/C/ltsp-updates.html#id531224 Details follow: Christian Herzog discovered that it was possible to connect to any LTSP client's X session over the network. A remote attacker could eavesdrop on X events, read window contents, and record keystrokes, possibly gaining access to private information. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-610-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17723 | |||
| Oval ID: | oval:org.mitre.oval:def:17723 | ||
| Title: | USN-610-1 -- ltsp vulnerability | ||
| Description: | Christian Herzog discovered that it was possible to connect to any LTSP client's X session over the network. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-610-1 CVE-2008-1293 | Version: | 9 |
| Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | ltsp |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20319 | |||
| Oval ID: | oval:org.mitre.oval:def:20319 | ||
| Title: | DSA-1561-1 ltsp - information disclosure | ||
| Description: | Christian Herzog discovered that within the Linux Terminal Server Project, it was possible to connect to X on any LTSP client from any host on the network, making client windows and keystrokes visible to that host. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1561-1 CVE-2008-1293 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ltsp |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7398 | |||
| Oval ID: | oval:org.mitre.oval:def:7398 | ||
| Title: | DSA-1561 ldm -- programming error | ||
| Description: | Christian Herzog discovered that within the Linux Terminal Server Project, it was possible to connect to X on any LTSP client from any host on the network, making client windows and keystrokes visible to that host. NOTE: most ldm installs are likely to be in a chroot environment exported over NFS, and will not be upgraded merely by upgrading the server itself. For example, on the i386 architecture, to upgrade ldm will likely require: | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1561 CVE-2008-1293 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ldm |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-23 | Name : Ubuntu Update for ltsp vulnerability USN-610-1 File : nvt/gb_ubuntu_USN_610_1.nasl |
| 2008-04-30 | Name : Debian Security Advisory DSA 1561-1 (ldm) File : nvt/deb_1561_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 44681 | ldm X11 Forwarding LTSP Client Connection Restriction Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-05-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-610-1.nasl - Type : ACT_GATHER_INFO |
| 2008-05-01 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1561.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:05:05 |
|
