[5342] in bugtraq
Re: Possible weakness in LPD protocol
daemon@ATHENA.MIT.EDU (Eivind Eklund)
Fri Oct 3 19:42:09 1997
Date: Fri, 3 Oct 1997 22:19:50 +0200
Reply-To: Eivind Eklund <perhaps@YES.NO>
From: Eivind Eklund <perhaps@YES.NO>
X-To: Thomas Roessler <roessler@GUUG.DE>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Thomas Roessler's message of Fri, 3 Oct 1997 02:43:16 +0200
>
> On October 02 1997, Bennett Samowich wrote:
>
> > 1.) Obtaining hard (or possibly soft) copies of any file on the system.
> > 2.) Deleting any file on the system.
> > 3.) Creating a file on the system.
> > 4.) Mail bombing.
>
> 5.) Overflow at least one buffer from the network; this is just
> above the "print any file" part of recvjob.c:
>
> cp = line;
> do {
> if ((size = read(1, cp, 1)) != 1) {
> if (size < 0)
> frecverr("%s: Lost connection",printer);
> return(nfiles);
> }
> } while (*cp++ != '\n');
>
>
> Consequences aren't really obvious, but you may be able to do
> nasty things.
>
> Will we ever get rid of gets()? (lpd source tree is from some
> recent RedHat distribution.)
This is fixed in OpenBSD and FreeBSD. Linux people should learn to
track what others do ;-)
The problems with '/' in filenames is fixed, too. The mail-bombing
might still be an issue, but there are lots of other ways to do that,
so I don't really think it warrants our attention (besides which I
can't see any way to fix it).
Eivind.
