Date: Sun, 17 Oct 1999 23:13:04 -0400
From: Bill Nottingham notting@redhat.com
To: redhat-watch-list@redhat.com
Red Hat, Inc. Security Advisory
Synopsis: File access problems in lpr/lpd
Advisory ID: RHSA-1999:041-01
Issue date: 1999-10-17
Updated on:
Keywords: lpr lpd permissions
Cross references:
1. Topic:
There are potential problems with file access checking in the
lpr and lpd programs. These could allow users to potentially print
files they do not have access to. Also, there are bugs in remote
printing in the lpd that shipped with Red Hat Linux 6.1.
2. Bug IDs fixed (http://developer.redhat.com/bugzilla
for more info):
5122 5540 5697 5832 5835 5903 5949
3. Relevant releases/architectures:
Red Hat Linux 4.x, all architectures
Red Hat Linux 5.x, all architectures
Red Hat Linux 6.x, all architectures
4. Obsoleted by:
5. Conflicts with:
6. RPMs required:
Red Hat Linux 4.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm
Red Hat Linux 5.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm
Red Hat Linux 6.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm
7. Problem description:
There are two problems in the lpr and lpd programs. By
exploiting a race between the access check and the actual file
opening, it is potentially possible to have lpr read a file as root
that the user does not have access to. Also, the lpd program would
blindly open queue files as root; by use of the ‘-s’ flag to lpr,
it was possible to have lpd print files that the user could not
access.
Thanks go to Tymm Twillman for pointing out these
vulnerabilities.
Also, various bugs in remote printing that were present in the
lpd released with Red Hat Linux 6.1 have been fixed.
8. Solution:
For each RPM for your particular architecture, run:
rpm -Uvh
where filename is the name of the RPM.
9. Verification:
MD5 sum Package Name
fb854cbddc9e38847c31aa6e07904ae6 lpr-0.43-0.4.2.i386.rpm 10d7f947c5e1e2ac13c88fec95e53838 lpr-0.43-0.4.2.alpha.rpm aea5f8564289be2f344169ba89da5ff7 lpr-0.43-0.4.2.sparc.rpm faaa81630ac3d5de295deec4c0cb2883 lpr-0.43-0.4.2.src.rpm 39dddd66751ae7e8e5b6fc179d61dd88 lpr-0.43-0.5.2.i386.rpm 479537d92946838857276967d6fb4e98 lpr-0.43-0.5.2.alpha.rpm b8c3970d327b1bdd3c14b933b4dab5c0 lpr-0.43-0.5.2.sparc.rpm 3aa3386da05e96adc04db5b376f307dd lpr-0.43-0.5.2.src.rpm cc1f97635c0a1029febc1f0e75e40527 lpr-0.43-2.i386.rpm 9c611726e6ec6f754e0b6503f87b8e97 lpr-0.43-2.alpha.rpm 1e8ff6f9f3272f30ca96f4dcdfdc9b53 lpr-0.43-2.sparc.rpm 2c258e8aa98f5b005b326f3110410965 lpr-0.43-2.src.rpm
These packages are signed with GnuPG by Red Hat Inc. for
security. Our key is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm –checksig
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:
rpm –checksig –nogpg
Note that you need RPM >= 3.0 to check GnuPG keys.
10. References: