LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty     value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session     script. (CVE-2019-20373)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project incorrectly parsed responses from an SSH server which could result in local root privilege escalation.

For Debian 8 'Jessie', this issue has been fixed in ldm version 2:2.2.15-2+deb8u1.

We recommend that you upgrade your ldm packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project, incorrectly parsed responses from an SSH server, which could result in local root privilege escalation.

ID	Name	Product	Family	Type	Severity
260849	Linux Distros Unpatched Vulnerability : CVE-2019-20373	Nessus	Misc.	Local	high
132776	Debian DLA-2064-1 : ldm security update	Nessus	Debian Local Security Checks	Local	high
132761	Debian DSA-4601-1 : ldm - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2019-20373

high

Tenable Plugins

high

high

high