The debian-private mailing list leak, part 1. Volunteers have complained about Blackmail. Lynchings. Character assassination. Defamation. Cyberbullying. Volunteers who gave many years of their lives are picked out at random for cruel social experiments. The former DPL's girlfriend Molly de Blanc is given volunteers to experiment on for her crazy talks. These volunteers never consented to be used like lab rats. We don't either. debian-private can no longer be a safe space for the cabal. Let these monsters have nowhere to hide. Volunteers are not disposable. We stand with the victims.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: SECURITY: [linux-alert] LSF Update#14: Vulnerability of the lpr program. AUSCERT 9610291550
On Sat, 23 Nov 1996, Alexander O. Yuriev wrote:
alex> No problem. It was made publically available a while ago... Please drop me a
alex> note when you test it.
Yes, Debian is vulnerable. Thats what I did:
bash> whoami
winni
bash> gcc -o exploit exploit.c
bash> ./exploit
bash# whoami
root
bash# dpkg --status lpr
Package: lpr
Section: net
[..]
Maintainer: Sven Rudolph <sr1@inf.tu-dresden.de>
Version: 5.9-12
[..]
Description: Berkeley lpr/lpd line printer spooling system
This is the standards UNIX printer spooler and associated utilties.
You can use this for local and remote printers.
I suggest the following text for the section about Debian (please edit it,
English is not my native language):
The standard configuration of Debian/GNU Linux (all versions)
is to install the "lpr"-package that contains the vulnerable
"lpr"-utility.
The alternate Debian-package named "lprng" does contain a totally
different "lpr"-utility that is _not_ vulnerable. But this package
is not installed by default.
To check what package you have installed just execute the commands
dir /usr/bin/lpr
dpkg --status lprng
If they print out
-rwsr-sr-x 1 root lp 14169 Jul 29 23:25 /usr/bin/lpr
Package `lprng' is not installed and no info is available.
it indicates that (a) you have a "lpr"-utility installed and
(b) it is _not_ the "safe" version. In this case you should
immediatly install the "lprng"-package by fetching the
appropreciate package for your architecture ("i386" for intel
PCs or "m68k" for Motorola-based systems) from
ftp://ftp.debian.org/debian/project/experimental/lprng_2.3.12-2_i386.deb
ftp://ftp.debian.org/debian/project/experimental/lprng_2.3.12-3_m68k.deb
The installation of the package is straightforward, e.g.
dpkg --install lprng_2.3.12-2_i386.deb
for the i386-architecture.
NOTE: After installing the "lprng"-package the unsecure "lpr"
seems to be installed, too. *THATS OK.*
It's because the configuration-files (/etc/printcap) are
not deleted but re-used by "lprng". The binaries of "lpr"
are deleted and replaced by "safe" lprng-binaries. You
can confirm this by executing "dpkg --status lpr" which
should report "Status: install ok config-files".
Hm. Longer than I first thought.
-Winfried
--
Please respect the confidentiality of material on the debian-private list.
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com