| Name | CVE-2008-1293 |
| Description | ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 (aka display :6). |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-1561-1, DTSA-118-1 |
| Debian Bugs | 469462 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| ltsp (PTS) | bullseye | 21.01-1+deb11u1 | fixed |
| bookworm | 23.02-1+deb12u1 | fixed |
| sid, trixie | 23.02-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| ldm | source | lenny | 2:0.1~bzr20071217-1+lenny1 | | DTSA-118-1 | |
| ldm | source | (unstable) | 2:0.1~bzr20080308-1 | | | 469462 |
| ltsp | source | etch | 0.99debian11+etch1 | | DSA-1561-1 | |
| ltsp | source | (unstable) | 5.0.40~bzr20071229-1 | | | |
Notes
In revision 5.0.40~bzr20071229-1 ldm has been split into a separate source package