gentoo-overlay/metadata/glsa/glsa-200805-07.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200805-07">
  <title>Linux Terminal Server Project: Multiple vulnerabilities</title>
  <synopsis>
    Multiple vulnerabilities have been discovered in components shipped with
    LTSP which allow remote attackers to compromise terminal clients.
  </synopsis>
  <product type="ebuild">ltsp</product>
  <announced>2008-05-09</announced>
  <revised count="01">2008-05-09</revised>
  <bug>215699</bug>
  <access>remote</access>
  <affected>
    <package name="net-misc/ltsp" auto="yes" arch="*">
      <vulnerable range="lt">5.0</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    The Linux Terminal Server Project adds thin-client support to Linux
    servers.
    </p>
  </background>
  <description>
    <p>
    LTSP version 4.2, ships prebuilt copies of programs such as the Linux
    Kernel, the X.org X11 server (GLSA 200705-06, GLSA 200710-16, GLSA
    200801-09), libpng (GLSA 200705-24, GLSA 200711-08), Freetype (GLSA
    200705-02, GLSA 200705-22) and OpenSSL (GLSA 200710-06, GLSA 200710-30)
    which were subject to multiple security vulnerabilities since 2006.
    Please note that the given list of vulnerabilities might not be
    exhaustive.
    </p>
  </description>
  <impact type="normal">
    <p>
    A remote attacker could possibly exploit vulnerabilities in the
    aforementioned programs and execute arbitrary code, disclose sensitive
    data or cause a Denial of Service within LTSP 4.2 clients.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    LTSP 4.2 is not maintained upstream in favor of version 5. Since
    version 5 is not yet available in Gentoo, the package has been masked.
    We recommend that users unmerge LTSP:
    </p>
    <code>
    # emerge --unmerge net-misc/ltsp</code>
    <p>
    If you have a requirement for Linux Terminal Servers, please either set
    up a terminal server by hand or use one of the distributions that
    already migrated to LTSP 5. If you want to contribute to the
    integration of LTSP 5 in Gentoo, or want to follow its development,
    find details in bug 177580.
    </p>
  </resolution>
  <references>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200705-02.xml">GLSA 200705-02</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200705-06.xml">GLSA 200705-06</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200705-22.xml">GLSA 200705-22</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200705-24.xml">GLSA 200705-24</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200710-06.xml">GLSA 200710-06</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200710-16.xml">GLSA 200710-16</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200710-30.xml">GLSA 200710-30</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200711-08.xml">GLSA 200711-08</uri>
    <uri link="https://www.gentoo.org/security/en/glsa/glsa-200801-09.xml">GLSA 200801-09</uri>
    <uri link="https://bugs.gentoo.org/177580">Gentoo bug 177580: Port LTSP 5 to Gentoo</uri>
  </references>
  <metadata tag="requester" timestamp="2008-04-01T19:23:11Z">
    rbu
  </metadata>
  <metadata tag="bugReady" timestamp="2008-04-03T14:49:37Z">
    rbu
  </metadata>
  <metadata tag="submitter" timestamp="2008-04-03T22:27:26Z">
    rbu
  </metadata>
</glsa>