Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

LTSP lets attackers connect to X server on port 6006

CVE-2008-1293 · published 18 years ago
Summary

The Linux Terminal Server Project (LTSP) version 0.99 and 2 on Debian passes a setting that opens the X display service on TCP port 6006. This allows anyone on the network to connect to the graphical session of each client, potentially seeing or controlling what is shown on the screen. To protect against this, disable the remote X access option, restrict the port with a firewall, or upgrade to a configuration that does not expose the X server.

What to do
  • Update debian ltsp to version 5.0.40~bzr20071229-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian ltsp < 5.0.40~bzr20071229-1
Fix: upgrade to 5.0.40~bzr20071229-1
Debian:13 debian ltsp < 5.0.40~bzr20071229-1
Fix: upgrade to 5.0.40~bzr20071229-1
Debian:14 debian ltsp < 5.0.40~bzr20071229-1
Fix: upgrade to 5.0.40~bzr20071229-1
– ltsp linux_terminal_server_project 0.99
2
cpe:2.3:a:ltsp:linux_terminal_server_project:0.99:*:*:*:*:*:*:*
Original advisory text
ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 (aka disp...
ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 (aka display :6).
References
Severity
4.8 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published29 Apr 2008
Updated4 Nov 2026
First seen20 Sep 2026
Sources
DEBIAN-CVE-2008-1293 · OSV
CVE-2008-1293 · NVD
Track software like this
Free during beta