Patrick Powell Information for VU#382365

• Vendor Information Help Date Notified:
• Statement Date:
• Date Updated: 05 Dec 2000

Status

Affected

Vendor Statement

Patrick Powell is the author responsible for development of this version of LPRng.

Extract from CHANGES in LPRng-3.6.25 distribution at:

ftp://ftp.astart.com/pub/LPRng/LPRng/LPRng-3.6.25.tgz

Release LPRng 3.6.25 Tue Oct 3 09:19:11 PDT 2000
syslog Compromise -
modified syslog to use 'syslog(xx,"%s", msg).
gettext Compromise -
added the following to Initialize():
if( getuid() == 0 || geteuid() == 0 ) unsetenv("NLSPATH");

See the various CERT advisories. Sigh...

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.