vendor:
Light Display Manager (LightDM)
by:
SecurityFocus
4,6
CVSS
MEDIUM
Local Arbitrary File Deletion
284
CWE
Product Name: Light Display Manager (LightDM)
Affected Version From: 1.0.6
Affected Version To: Other versions may also be affected.
Patch Exists: YES
Related CWE: N/A
CPE: a:canonical:lightdm
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012
Light Display Manager (LightDM) Local Arbitrary File Deletion Vulnerability
Light Display Manager (LightDM) is prone to a local arbitrary-file-deletion vulnerability. A local attacker can exploit this issue to delete arbitrary files with administrator privileges. Light Display Manager (LightDM) 1.0.6 is vulnerable. Other versions may also be affected. The vulnerability is caused by the /usr/sbin/guest-account script, which runs with the cwd of the last logged in user. If the user creates a file '/tmp/x a', the file 'a' gets removed from the last user's login.
Mitigation:
Ensure that the Light Display Manager (LightDM) is up to date and that all users are aware of the potential risks of creating files in the /tmp directory.
