Description
LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 10 | ldm | 2:2.18.06-1+deb10u1 | DSA-4601-1 |
| Debian 9 | ldm | 2:2.2.18-2+deb9u1 | DSA-4601-1 |
| Debian 8 | ldm | 2:2.2.15-2+deb8u1 | DLA-2064-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ldm | 2:2.18.06-1+deb10u1build0.20.04.1 | — |
| Ubuntu 18.04 LTS | ldm | No fix yet | — |
| Ubuntu 16.04 LTS | ldm | No fix yet | — |
Advisories 2
- DSA-4601-1 ldm - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2064-1 ldm - security update Debian Security (DSA / DLA) · Mar 9, 2026