Date: Sun, 17 Oct 1999 23:13:04 -0400
From: Bill Nottingham <notting@redhat.com>
To: redhat-watch-list@redhat.com
Subject: [linux-security] [RHSA-1999:041-01] File access problems in lpr/lpd
Cc: linux-security@redhat.com, bugtraq@securityfocus.com
*This message was transferred with a trial version of CommuniGate(tm) Pro*
---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: File access problems in lpr/lpd
Advisory ID: RHSA-1999:041-01
Issue date: 1999-10-17
Updated on:
Ключевые слова:, lpr, lpd, permissions, (найти похожие документы)
Cross references:
---------------------------------------------------------------------
1. Topic:
There are potential problems with file access checking in
the lpr and lpd programs. These could allow users to
potentially print files they do not have access to. Also,
there are bugs in remote printing in the lpd that shipped
with Red Hat Linux 6.1.
2. Bug IDs fixed (http://developer.redhat.com/bugzilla for more info):
5122 5540 5697 5832 5835 5903 5949
3. Relevant releases/architectures:
Red Hat Linux 4.x, all architectures
Red Hat Linux 5.x, all architectures
Red Hat Linux 6.x, all architectures
4. Obsoleted by:
5. Conflicts with:
6. RPMs required:
Red Hat Linux 4.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm
Red Hat Linux 5.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm
Red Hat Linux 6.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm
7. Problem description:
There are two problems in the lpr and lpd programs. By
exploiting a race between the access check and the actual
file opening, it is potentially possible to have lpr read
a file as root that the user does not have access to. Also,
the lpd program would blindly open queue files as root; by
use of the '-s' flag to lpr, it was possible to have lpd print
files that the user could not access.
Thanks go to Tymm Twillman for pointing out these
vulnerabilities.
Also, various bugs in remote printing that were present
in the lpd released with Red Hat Linux 6.1 have been fixed.
8. Solution:
For each RPM for your particular architecture, run:
rpm -Uvh <filename>
where filename is the name of the RPM.
9. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
fb854cbddc9e38847c31aa6e07904ae6 lpr-0.43-0.4.2.i386.rpm
10d7f947c5e1e2ac13c88fec95e53838 lpr-0.43-0.4.2.alpha.rpm
aea5f8564289be2f344169ba89da5ff7 lpr-0.43-0.4.2.sparc.rpm
faaa81630ac3d5de295deec4c0cb2883 lpr-0.43-0.4.2.src.rpm
39dddd66751ae7e8e5b6fc179d61dd88 lpr-0.43-0.5.2.i386.rpm
479537d92946838857276967d6fb4e98 lpr-0.43-0.5.2.alpha.rpm
b8c3970d327b1bdd3c14b933b4dab5c0 lpr-0.43-0.5.2.sparc.rpm
3aa3386da05e96adc04db5b376f307dd lpr-0.43-0.5.2.src.rpm
cc1f97635c0a1029febc1f0e75e40527 lpr-0.43-2.i386.rpm
9c611726e6ec6f754e0b6503f87b8e97 lpr-0.43-2.alpha.rpm
1e8ff6f9f3272f30ca96f4dcdfdc9b53 lpr-0.43-2.sparc.rpm
2c258e8aa98f5b005b326f3110410965 lpr-0.43-2.src.rpm
These packages are signed with GnuPG by Red Hat Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
Note that you need RPM >= 3.0 to check GnuPG keys.
10. References:
--
To unsubscribe: mail redhat-watch-list-request@redhat.com with
"unsubscribe" as the Subject.
--
To unsubscribe:
mail -s unsubscribe redhat-announce-list-request@redhat.com < /dev/null
--
----------------------------------------------------------------------
Please refer to the information about this list as well as general
information about Linux security at http://www.aoy.com/Linux/Security.
----------------------------------------------------------------------
To unsubscribe:
mail -s unsubscribe linux-security-request@redhat.com < /dev/null
