Patrick Powell Information for VU#382365

Patrick Powell is the author responsible for development of this version of LPRng.

Extract from CHANGES in LPRng-3.6.25 distribution at:

ftp://ftp.astart.com/pub/LPRng/LPRng/LPRng-3.6.25.tgz

Release LPRng 3.6.25 Tue Oct 3 09:19:11 PDT 2000
syslog Compromise -
modified syslog to use 'syslog(xx,"%s", msg).
gettext Compromise -
added the following to Initialize():
if( getuid() == 0 || geteuid() == 0 ) unsetenv("NLSPATH");

See the various CERT advisories. Sigh...

US-CERT Addendum

If you have feedback, comments, or additional information about this vulnerability, please send us email.