RCE in Canonical Ltsp Display Manager
CVE-2012-1166
The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.048 (91.1th percentile) — read the EPSS interpretation.
Affected products
- Canonical Ltsp_display_manager — versions 2.2.4, 2.2.5, 2.2.6
- Canonical Ubuntu_linux — versions 11.04, 11.10
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)