5549814 2000-10-04 20:26 /84 rader/ Brevbäraren (som är implementerad i) Python
Mottagare: Bugtraq (import) <13101>
Mottagare: Root (@) Nationernas Hus <12637>
Sänt: 2000-10-07 01:17
Mottagare: Red Hat Announce (import) <1597>
Sänt: 2000-10-07 01:17
Ärende: [RHSA-2000:065-04] LPRng contains a critical string format bug
------------------------------------------------------------
From: bugzilla@REDHAT.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Message-ID: <200010041604.e94G4cE25573@porkchop.redhat.com>
---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: LPRng contains a critical string format bug
Advisory ID: RHSA-2000:065-04
Issue date: 2000-09-26
Updated on: 2000-10-04
Product: Red Hat Linux
Keywords: LPRng security lpd printing lpr syslog
Cross references: N/A
---------------------------------------------------------------------
1. Topic:
LPRng has a string format bug in the use_syslog function which could
lead to root compromise.
2. Relevant releases/architectures:
Red Hat Linux 7.0 - i386
3. Problem description:
LPRng has a string format bug in the use_syslog function. This
function returns user input in a string that is passed to the
syslog() function as the format string. It is possible to corrupt
the print daemon's execution with unexpected format specifiers, thus
gaining root access to the computer. The vulnerability is
theoretically exploitable both locally and remotely.
4. Solution:
For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
17756 - Critical security hole in LPRng, remote root
6. RPMs required:
Red Hat Linux 7.0:
i386:
ftp://updates.redhat.com/7.0/i386/LPRng-3.6.24-2.i386.rpm
sources:
ftp://updates.redhat.com/7.0/SRPMS/LPRng-3.6.24-2.src.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
c1fc795122b067dd9549aceb75bf5694 7.0/SRPMS/LPRng-3.6.24-2.src.rpm
05251e71ae5f2d2fdbc6611eea6f8651 7.0/i386/LPRng-3.6.24-2.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
Originally reported to bugtraq by Chris Evans
<chris@scary.beasts.org> on 25 Sep, 2000.
Copyright(c) 2000 Red Hat, Inc.
(5549814) ------------------------------------------(Ombruten)