Bug 113349

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.1)
Gecko/20031114

Description of problem:
CUPS: Printer services

	When we configure and start a SMB printer, the password of samba are
parsed by command line, in the fact this is a security weakness. a
malicious user can momentanly stop 192.168.0.1 interface (by some
flood, rst flags, or something) and save "ps -aux" outputs frecuently...:

root     14679  0.0  0.5  9624 2124 ?        S    04:02   0:00
smb://unmanarc:12345678.0.1/HP 2 unmanarc (stdin)

this show samba user and password to all users of this "multi-user"
computer.



Version-Release number of selected component (if applicable):


How reproducible:
Sometimes

Steps to Reproduce:
While configuring printer:

1. Configure new smb printer with redhat-config-printer-gui
2. Before write the password of SMB and press enter, flood the network
with arp/rst and other mallicious packets to cause some latency on
network operations.
3. use: "watch 'ps -aux | grep smb'" as some user, and...:
root     19025  0.8  0.6  8012 2384 ?        S    18:31   0:00
/usr/bin/smbclient //192.168.0.1/HP 12345678 -W unmanarc -c quit -U
unmanarc

buhala, ip, password, group, user are revelated.

If Printer also configured, and when have problems connection to
192.168.0.1:
only 
1. ps -aux

Actual Results:  Result 1 (when configuring): 
root     19025  0.8  0.6  8012 2384 ?        S    18:31   0:00
/usr/bin/smbclient //192.168.0.1/HP 12345678 -W unmanarc -c quit -U
unmanarc

Result 2 (when trying to connect):
root     14679  0.0  0.5  9624 2124 ?        S    04:02   0:00
smb://unmanarc:12345678.0.1/HP 2 unmanarc (stdin)



Expected Results:  Result 1 (when configuring): 
root     19025  0.8  0.6  8012 2384 ?        S    18:31   0:00
/usr/bin/smbclient //192.168.0.1/HP **** -W unmanarc -c quit -U unmanarc

Result 2 (when trying to connect):
root     14679  0.0  0.5  9624 2124 ?        S    04:02   0:00
smb://unmanarc:****@192.168.0.1/HP 2 unmanarc (stdin)


Additional info:

parsing passwords as plain-text by the command line are bad idea since
all linux users can do "ps -aux"