[LI] [RHSA-1999:041-01] File access problems in lpr/lpd

[Bill Nottingham <notting@xxxxxxxxxx>]

FYI -- Raju

---------------------------------------------------------------------
		   Red Hat, Inc. Security Advisory

Synopsis:		File access problems in lpr/lpd
Advisory ID:		RHSA-1999:041-01
Issue date:		1999-10-17
Updated on:		
Keywords:		lpr lpd permissions
Cross references:	
---------------------------------------------------------------------

1. Topic:

There are potential problems with file access checking in
the lpr and lpd programs. These could allow users to
potentially print files they do not have access to. Also,
there are bugs in remote printing in the lpd that shipped
with Red Hat Linux 6.1.

2. Bug IDs fixed (http://developer.redhat.com/bugzilla for more info):

5122 5540 5697 5832 5835 5903 5949

3. Relevant releases/architectures:

Red Hat Linux 4.x, all architectures
Red Hat Linux 5.x, all architectures
Red Hat Linux 6.x, all architectures

4. Obsoleted by:

5. Conflicts with:

6. RPMs required:

Red Hat Linux 4.x:

Intel:
  ftp://ftp.redhat.com/pub/redhat/updates/4.2/i386/lpr-0.43-0.4.2.i386.rpm

Alpha:
  ftp://ftp.redhat.com/pub/redhat/updates/4.2/alpha/lpr-0.43-0.4.2.alpha.rpm

Sparc:
  ftp://ftp.redhat.com/pub/redhat/updates/4.2/sparc/lpr-0.43-0.4.2.sparc.rpm

Source packages:
  ftp://ftp.redhat.com/pub/redhat/updates/4.2/SRPMS/lpr-0.43-0.4.2.src.rpm

Red Hat Linux 5.x:

Intel:
  ftp://ftp.redhat.com/pub/redhat/updates/5.2/i386/lpr-0.43-0.5.2.i386.rpm

Alpha:
  ftp://ftp.redhat.com/pub/redhat/updates/5.2/alpha/lpr-0.43-0.5.2.alpha.rpm

Sparc:
  ftp://ftp.redhat.com/pub/redhat/updates/5.2/sparc/lpr-0.43-0.5.2.sparc.rpm

Source packages:
  ftp://ftp.redhat.com/pub/redhat/updates/5.2/SRPMS/lpr-0.43-0.5.2.src.rpm

Red Hat Linux 6.x:

Intel:
  ftp://ftp.redhat.com/pub/redhat/updates/6.1/i386/lpr-0.43-2.i386.rpm

Alpha:
  ftp://ftp.redhat.com/pub/redhat/updates/6.0/alpha/lpr-0.43-2.alpha.rpm

Sparc:
  ftp://ftp.redhat.com/pub/redhat/updates/6.0/sparc/lpr-0.43-2.sparc.rpm

Source packages:
  ftp://ftp.redhat.com/pub/redhat/updates/6.1/SRPMS/lpr-0.43-2.src.rpm

7. Problem description:

There are two problems in the lpr and lpd programs. By
exploiting a race between the access check and the actual
file opening, it is potentially possible to have lpr read
a file as root that the user does not have access to. Also,
the lpd program would blindly open queue files as root; by
use of the '-s' flag to lpr, it was possible to have lpd print
files that the user could not access.

Thanks go to Tymm Twillman for pointing out these
vulnerabilities.

Also, various bugs in remote printing that were present
in the lpd released with Red Hat Linux 6.1 have been fixed.

8. Solution:

For each RPM for your particular architecture, run:

rpm -Uvh <filename>

where filename is the name of the RPM.

9. Verification:

MD5 sum                           Package Name
--------------------------------------------------------------------------
fb854cbddc9e38847c31aa6e07904ae6  lpr-0.43-0.4.2.i386.rpm
10d7f947c5e1e2ac13c88fec95e53838  lpr-0.43-0.4.2.alpha.rpm
aea5f8564289be2f344169ba89da5ff7  lpr-0.43-0.4.2.sparc.rpm
faaa81630ac3d5de295deec4c0cb2883  lpr-0.43-0.4.2.src.rpm

39dddd66751ae7e8e5b6fc179d61dd88  lpr-0.43-0.5.2.i386.rpm
479537d92946838857276967d6fb4e98  lpr-0.43-0.5.2.alpha.rpm
b8c3970d327b1bdd3c14b933b4dab5c0  lpr-0.43-0.5.2.sparc.rpm
3aa3386da05e96adc04db5b376f307dd  lpr-0.43-0.5.2.src.rpm

cc1f97635c0a1029febc1f0e75e40527  lpr-0.43-2.i386.rpm
9c611726e6ec6f754e0b6503f87b8e97  lpr-0.43-2.alpha.rpm
1e8ff6f9f3272f30ca96f4dcdfdc9b53  lpr-0.43-2.sparc.rpm
2c258e8aa98f5b005b326f3110410965  lpr-0.43-2.src.rpm

These packages are signed with GnuPG by Red Hat Inc. for security. Our key
is available at:

http://www.redhat.com/corp/contact.html

You can verify each package with the following command:

rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:

rpm --checksig --nogpg <filename>

Note that you need RPM >= 3.0 to check GnuPG keys.

10. References:
--------------------------------------------------------------------
The Linux India Mailing List Archives are now available.  Please search
the archive at http://lists.linux-india.org/ before posting your question
to avoid repetition and save bandwidth.