There are potential problems with file access checking in
the lpr and lpd programs. These could allow users to
potentially print files they do not have access to. Also,
there are bugs in remote printing in the lpd that shipped
with Red Hat Linux 6.1.
There are two problems in the lpr and lpd programs. By
exploiting a race between the access check and the actual
file opening, it is potentially possible to have lpr read
a file as root that the user does not have access to. Also,
the lpd program would blindly open queue files as root; by
use of the '-s' flag to lpr, it was possible to have lpd print
files that the user could not access.
Thanks go to Tymm Twillman for pointing out these
vulnerabilities.
Also, various bugs in remote printing that were present
in the lpd released with Red Hat Linux 6.1 have been fixed.
8. Solution:
For each RPM for your particular architecture, run:
rpm -Uvh <filename>
where filename is the name of the RPM.
9. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
fb854cbddc9e38847c31aa6e07904ae6 lpr-0.43-0.4.2.i386.rpm
10d7f947c5e1e2ac13c88fec95e53838 lpr-0.43-0.4.2.alpha.rpm
aea5f8564289be2f344169ba89da5ff7 lpr-0.43-0.4.2.sparc.rpm
faaa81630ac3d5de295deec4c0cb2883 lpr-0.43-0.4.2.src.rpm
