Lpd/lpr hole allows users to print files they do not have access to
18 Oct. 1999
Summary
The lpr/lpd that are shipped with Redhat 4.x, 5.x and 6.x and Debian 2.1 suffer from a vulnerability that allows local users to print files they should normally have no read access to.
This problem has been fixed, and new packages are available from Redhat and Debian.
Credit:
These vulnerabilities were discovered by Tymm Twillman.
The lpr version that is shipped with the Redhat and Debian distributions (and possibly other distributions as well) suffers from a race condition between the access check and the actual opening of the file. This 'race condition' enables users to print files they do not have read access to.
The lpd blindly opens files as root, using the -s flag. This is done without checking whether the user should have access to that file and therefore allows users to print files they shouldn't normally see.
Fix Information
Redhat has provided a new RPM, which solves this problem.
