First Last Prev Next    This bug is not in your last search results.
Bug 24260 - Apparent security hole in lpd
Apparent security hole in lpd
Status: CLOSED RAWHIDE
Product: Red Hat Linux
Classification: Retired
Component: lpr (Show other bugs)
7.0
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Crutcher Dunnavant
David Lawrence
: Security
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2001-01-17 23:18 EST by Frank Jas
Modified: 2007-04-18 12:30 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-01-22 05:22:07 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Frank Jas 2001-01-17 23:18:42 EST 
A hacker gained root access to my system apparently via 'lpd'.
The evidence I have that 'lpd' was comprimised are two facts:

some of the original files were created with group 'lp'
the 'rootkit' scripts used by the hacker after gaining
access removed/replaced 'lpd' for no apparent reason.

I have file a report with CERT.
I have a copy of all the 'rootkit' scripts used by the hacker.
Comment 1 Daniel Roesen 2001-01-22 05:22:03 EST 
Did you update LPRng as suggested by Red Hat's security advisory issued several
months ago? See:

http://www.redhat.com/support/errata/RHSA-2000-065-06.html
Comment 2 Crutcher Dunnavant 2001-03-27 18:05:39 EST 
looks like the ramen worm or a variant. Yes, it should have been closed by the
errata.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.