RedHat lpr/lpd Vulnerabilities
BID:718
Info
RedHat lpr/lpd Vulnerabilities
| Bugtraq ID: | 718 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 18 1999 12:00AM |
| Updated: | Oct 18 1999 12:00AM |
| Credit: | Released in RedHat advisory RHSA-1999:041-01 on October 17, 1999. |
| Vulnerable: |
Redhat Linux 6.1 i386 Redhat Linux 6.0 Redhat Linux 5.2 i386 Redhat Linux 5.1 Redhat Linux 5.0 Redhat Linux 4.2 Redhat Linux 4.1 Redhat Linux 4.0 |
| Not Vulnerable: | |
Discussion
RedHat lpr/lpd Vulnerabilities
The lpr packages that ship with RedHat Linux releases 4.x to 6.1 contain vulnerabilities which may allow printing of files for which read access is not allowed. The first of the two problems is a race condition that can be exploited between the access checking and the opening of the file. The second is a symlink attack that could also be used to print files that normally cannot be read by a regular user (through lpr -s).
The lpr packages that ship with RedHat Linux releases 4.x to 6.1 contain vulnerabilities which may allow printing of files for which read access is not allowed. The first of the two problems is a race condition that can be exploited between the access checking and the opening of the file. The second is a symlink attack that could also be used to print files that normally cannot be read by a regular user (through lpr -s).
Exploit / POC
RedHat lpr/lpd Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RedHat lpr/lpd Vulnerabilities
Solution:
Patched versions of the lpr packages are available at the links listed below:
Red Hat Linux 4.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm
Red Hat Linux 5.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm
Red Hat Linux 6.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm
The MD5 sums for each of these packages is available in the advisory linked to from the references section.
Solution:
Patched versions of the lpr packages are available at the links listed below:
Red Hat Linux 4.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm
Red Hat Linux 5.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm
Red Hat Linux 6.x:
Intel:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm
Alpha:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm
Sparc:
ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm
Source packages:
ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm
The MD5 sums for each of these packages is available in the advisory linked to from the references section.