--------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: File access problems in lpr/lpd Advisory ID: RHSA-1999:041-01 Issue date: 1999-10-17 Updated on: Keywords: lpr lpd permissions Cross references: --------------------------------------------------------------------- 1. Topic: There are potential problems with file access checking in the lpr and lpd programs. These could allow users to potentially print files they do not have access to. Also, there are bugs in remote printing in the lpd that shipped with Red Hat Linux 6.1. 2. Bug IDs fixed (http://developer.redhat.com/bugzilla for more info): 5122 5540 5697 5832 5835 5903 5949 3. Relevant releases/architectures: Red Hat Linux 4.x, all architectures Red Hat Linux 5.x, all architectures Red Hat Linux 6.x, all architectures 4. Obsoleted by: 5. Conflicts with: 6. RPMs required: Red Hat Linux 4.x: Intel: ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm Alpha: ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm Sparc: ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm Source packages: ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm Red Hat Linux 5.x: Intel: ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm Alpha: ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm Sparc: ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm Source packages: ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm Red Hat Linux 6.x: Intel: ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm Alpha: ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm Sparc: ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm Source packages: ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm 7. Problem description: There are two problems in the lpr and lpd programs. By exploiting a race between the access check and the actual file opening, it is potentially possible to have lpr read a file as root that the user does not have access to. Also, the lpd program would blindly open queue files as root; by use of the '-s' flag to lpr, it was possible to have lpd print files that the user could not access. Thanks go to Tymm Twillman for pointing out these vulnerabilities. Also, various bugs in remote printing that were present in the lpd released with Red Hat Linux 6.1 have been fixed. 8. Solution: For each RPM for your particular architecture, run: rpm -Uvh <filename> where filename is the name of the RPM. 9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- fb854cbddc9e38847c31aa6e07904ae6 lpr-0.43-0.4.2.i386.rpm 10d7f947c5e1e2ac13c88fec95e53838 lpr-0.43-0.4.2.alpha.rpm aea5f8564289be2f344169ba89da5ff7 lpr-0.43-0.4.2.sparc.rpm faaa81630ac3d5de295deec4c0cb2883 lpr-0.43-0.4.2.src.rpm 39dddd66751ae7e8e5b6fc179d61dd88 lpr-0.43-0.5.2.i386.rpm 479537d92946838857276967d6fb4e98 lpr-0.43-0.5.2.alpha.rpm b8c3970d327b1bdd3c14b933b4dab5c0 lpr-0.43-0.5.2.sparc.rpm 3aa3386da05e96adc04db5b376f307dd lpr-0.43-0.5.2.src.rpm cc1f97635c0a1029febc1f0e75e40527 lpr-0.43-2.i386.rpm 9c611726e6ec6f754e0b6503f87b8e97 lpr-0.43-2.alpha.rpm 1e8ff6f9f3272f30ca96f4dcdfdc9b53 lpr-0.43-2.sparc.rpm 2c258e8aa98f5b005b326f3110410965 lpr-0.43-2.src.rpm These packages are signed with GnuPG by Red Hat Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg <filename> Note that you need RPM >= 3.0 to check GnuPG keys. 10. References:
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:07:41 PDT