USN-610-1: LTSP vulnerability

Releases

• Ubuntu 7.10
• Ubuntu 7.04
• Ubuntu 6.06

Packages

• ltsp -

Details

Christian Herzog discovered that it was possible to connect to any
LTSP client's X session over the network. A remote attacker could
eavesdrop on X events, read window contents, and record keystrokes,
possibly gaining access to private information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10

• ldm - 5.0.39.1

Ubuntu 7.04

• ldm - 5.0.7.1

Ubuntu 6.06

• ldm - 0.87.1

After a standard system upgrade you need to update your LTSP client chroots
to effect the necessary changes. For more details, please see:
http://doc.ubuntu.com/edubuntu/edubuntu/handbook/C/ltsp-updates.html#id531224

References

• CVE-2008-1293