Bug reported:

From: Sheshep ankh Dubhe [dubhe.ORG]
Sent: Wednesday, March 08, 2000 2:44 PM
To: BUGTRAQ
Subject: [ Hackerslab bug_paper ] Linux printtool get printer password


[ Hackerslab bug_paper ] Linux printtool get printer password

File : /usr/bin/printtool

SYSTEM : Linux

INFO :

If make printer configuration by printtool package, It make vule config
file.
Config file perrmission is "-rw-r--r-- root root".
If use samba network printer, password stored in config file.

Tested platform : RedHat 6.1 - 6.2B
printtool-3.41-2
printtool-3.42-3ac
printtool-3.43-1

[dubhe@duat dubhe]$ ls -lsa /var/spool/lpd/lp/.config
   1 -rw-r--r--   1 root     root           96 Mar  6
13:21 /var/spool/lpd/lp/.config
[dubhe@duat dubhe]$ cat /var/spool/lpd/lp/.config
share='\\xxxxx\HP'
hostip=xxx.xxx.xxx.xxx
user='username'
password='1111'
workgroup='xxxxxxxx'

 Now to fix
------------

chmod o-r /var/spool/lpd/lp/.config
chgrp lp /var/spool/lpd/lp/.config

- Kyong-won, Cho -
e-mail : dubhe dubhe.org