CVE-2019-20373 Privilege escalation in n/a
Attackers can gain root access on LTSP fat clients if the user's shell lacks Bourne shell support, allowing empty username variables in session scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20373?
CVE-2019-20373 is a high-severity vulnerability in Debian Debian Linux, published on 9 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.
Which versions are affected by CVE-2019-20373?
It affects 2 products.
Products include Debian Debian Linux, Ltsp Ldm.
How do I fix CVE-2019-20373?
Apply the vendor's patch.
Is CVE-2019-20373 being exploited?
There is no known exploitation of CVE-2019-20373 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DLA-2064-1, DSA-4601-1, GHSA-7fp6-mjg4-r496, UBUNTU-CVE-2019-20373.