PISA-08-JAN-00-002

[David Webster <cog@seul.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

              .------------------------------------------------.
              |**** Project Independence Security Advisory ****|
              `-----------* ID: PISA-08-JAN-00-002 *-----------'
                    Issued by: David Webster <cog@seul.org>

Issue Date: 08-JAN-99

Overview: Two security problems in ldp, fixed by upgrading lpr package 

Affected: Independence Release 6.0-0.8

References: RedHat Security Advisory: RHSA-2000:002-01

                                  -=-=-==-=-=-

Detailed Problem Description:

	Two security vulnerabilities exist in the lpd
	(line printer daemon) shipped with the lpr package.
	
	First, authentication was not thorough enough. If a remote user
	was able to control their own DNS so that their IP address resolved
	to the hostname of the print server, access would be granted,
	when it should not be.

	Secondly, it was possible in the control file of a print job
	to specify arguments to sendmail. By careful manipulation of
	control and data files, this could cause sendmail to be executed
	with a user-specified configuration file. This could lead
	very easily to a root compromise.
	
	It is recommended that all users of the	lpr package (which is 
	required to print) upgrade to the fixed packages.


Solution:

        Update the affected RPM packages by downloading and
        installing the RPMs listed below. For each RPM, run:
        
                root# rpm -Fvh <filename>

        where <filename> is the name of the RPM.

        [Note: You need only install EITHER the compiled RPM,
        (*.i386.rpm) OR the source RPM, (*.src.rpm), NOT both.]

RPMs:

  http://independence.seul.org/security/2000/rpms/lpr-0.48-1.i386.rpm
  ftp://updates.redhat.com/6.1/i386/lpr-0.48-1.i386.rpm

Source RPMs:

  http://independence.seul.org/security/2000/rpms/lpr-0.48-1.src.rpm
  ftp://updates.redhat.com/6.1/SRPMS/lpr-0.48-1.src.rpm

Verification:

MD5 sum                           Package Name
- --------------------------------------------------------------------------
78f2220331189e723eab944b53d0710e  i386/lpr-0.48-1.i386.rpm
55c6a740b03569919ec08992257cad96  SRPMS/lpr-0.48-1.src.rpm
- --------------------------------------------------------------------------

These packages are GPG signed by Red Hat, Inc. for security.
Their key is available at: http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

This security advisory, and all future ones should be signed by me,
David Webster (aka cognition), with key ID: 45 FA C2 83

An archive of these messages can be currently be found on:
http://independence.seul.org/security/

A process of automatic retrieval is being worked on.

[Note: these problems were discovered, and fixed by RedHat.]

Thanks also go to DilDog <dildog@l0pht.com> for discovering the vulnerability.

        .---------------------------------------------------.
        | And problems regarding this, or future advisories |
        |      should be emailed to me: <cog@seul.org>      |
        `---------------------------------------------------'
-----BEGIN PGP SIGNATURE-----
Comment: David Webster (aka cogNiTioN) <http://www.cognite.net/>

iD8DBQE4d0SODdLNO0X6woMRAvasAJsExF6n3NHInflOKKYE5x9RfoQ2JACg29WT
dZYZ3wFzeZa7heGXBnxpTqw=
=BbAq
-----END PGP SIGNATURE-----