Red Hat Security Advisory: LPRng contains a critical string format bugOct 04, 2000, 20:41 (0 Talkback[s])
Date: Wed, 4 Oct 2000 12:04:00 -0400
Red Hat, Inc. Security Advisory Synopsis: LPRng contains a critical string format bug Advisory ID: RHSA-2000:065-04 Issue date: 2000-09-26 Updated on: 2000-10-04 Product: Red Hat Linux Keywords: LPRng security lpd printing lpr syslog Cross references: N/A
LPRng has a string format bug in the use_syslog function which could lead to root compromise.
2. Relevant releases/architectures:
Red Hat Linux 7.0 - i386
3. Problem description:
LPRng has a string format bug in the use_syslog function. This function returns user input in a string that is passed to the syslog() function as the format string. It is possible to corrupt the print daemon's execution with unexpected format specifiers, thus gaining root access to the computer. The vulnerability is theoretically exploitable both locally and remotely.
For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
17756 - Critical security hole in LPRng, remote root
6. RPMs required:
Red Hat Linux 7.0:
MD5 sum Package Name
c1fc795122b067dd9549aceb75bf5694 7.0/SRPMS/LPRng-3.6.24-2.src.rpm 05251e71ae5f2d2fdbc6611eea6f8651 7.0/i386/LPRng-3.6.24-2.i386.rpmThese packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
You can verify each package with the following command:
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
Originally reported to bugtraq by Chris Evans email@example.com on 25 Sep, 2000.
Copyright(c) 2000 Red Hat, Inc.