NEOHAPSIS - Peace of Mind Through Integrity and Insight

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > Bugtraq> 2000-10

Subject: Conectiva Linux Security Announcement - lpr
From: secureCONECTIVA.COM.BR
Date: Thu Oct 05 2000 - 16:02:05 CDT

Next message: Oliver Friedrichs: "SECPROG mailing list."
Previous message: Pascal Bouchareine: "HERT advisory: FreeBSD IP Spoofing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
-----------------------------------------------------------------------

PACKAGE : lpr
SUMMARY : Possible local root exploit
DATE : 2000-10-05 18:01:00
RELEVANT
RELEASES : 4.0, 4.0es, 4.1, 4.2, 5.0, prg gráficos, ecommerce, 5.1

----------------------------------------------------------------------

DESCRIPTION
There is a format bug in lpd in a syslog() call that could be used to
obtain root access. The exploit would have to successfully inject
format strings in a hostname to cause damage.

SOLUTION
All users should upgrade to the updated packages.

We would like to thank Chris Evans for spotting this problem
elsewhere and bringing it up to the attention of the linux vendors.

----------------------------------------------------------------------

All packages are signed with Conectiva's GPG key. The key can be
obtained at http://www.conectiva.com.br/contato

----------------------------------------------------------------------
subscribe: atualizacoes-anuncio-subscribebazar.conectiva.com.br
unsubscribe: atualizacoes-anuncio-unsubscribebazar.conectiva.com.br

Next message: Oliver Friedrichs: "SECPROG mailing list."
Previous message: Pascal Bouchareine: "HERT advisory: FreeBSD IP Spoofing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]