CVE-2019-20373: High severity debian linux vulnerability
LTSP LDM through 2.18.06 allows fat-client root access because the LDMUSERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20373?
CVE-2019-20373 is considered a high-risk vulnerability due to its potential to allow root access to fat clients.
How do I fix CVE-2019-20373?
To fix CVE-2019-20373, upgrade to the patched version 2:2.18.06-1+deb10u1 or later for the ldm package.
Which systems are affected by CVE-2019-20373?
CVE-2019-20373 affects Debian Linux versions 8.0, 9.0, and 10.0, as well as LTSP LDM versions up to 2.18.06.
What causes the vulnerability in CVE-2019-20373?
CVE-2019-20373 is caused by the LDM_USERNAME variable potentially having an empty value in certain shell environments.
Can CVE-2019-20373 be exploited remotely?
Yes, CVE-2019-20373 can be exploited remotely, leading to unauthorized root access on vulnerable systems.