Bug 53784 - Possible security problem with LPRng 3.7.5 and 3.7.6
Summary: Possible security problem with LPRng 3.7.5 and 3.7.6
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Raw Hide
Classification: Retired
Component: LPRng
Version: 1.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tim Waugh
QA Contact: Brock Organ
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-09-18 16:37 UTC by Pekka Savola
Modified: 2007-04-18 16:37 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2002-01-07 17:11:38 UTC
Embargoed:

Attachments (Terms of Use)

Description Pekka Savola 2001-09-18 16:37:39 UTC 
I don't think that RH ever released 3.7.5 or 3.7.6 (rather, patched 3.7.4), but as there might have 
been some patches to the code, better safe than sorry...

--8<--

Date: Tue, 18 Sep 2001 07:06:41 -0700 (PDT)
From: User Papowell <papowell>
Reply-To: lprng
To: lprng
Subject: LPRng: LPRng 3.7.7 + Security Bulletin

Please do not use LPRng 3.7.5, 3.7.6.  There is a possible
security problem with them.

Details:

  In fixing a problem with 'additional groups' I wrote a routine
that got the group for use when running as a server and then set
the group and additional groups.  This 'setgroup' should be done
ONLY for 'lpd'.  The code that is in 3.7.5 and 3.7.6 does it for
lpq and lpr as well.

There is a possibility that by using this users could access files
for which the lpd user ('daemon' by default and 'lp' by on most
RedHat RPM installations) could read files which had group ownership
'daemon' (or lp).

Patrick ("Doh! I knew that! Dumb! Dumb!") Powell
Comment 1 Tim Waugh 2002-01-21 10:56:45 UTC 
Indeed, we have only shipped 3.7.4+patches, and not 3.7.5 or later.  Thanks 
for letting us know about this though.
Note You need to log in before you can comment on or make changes to this bug.