Patrick Powell Information for VU#382365
LPRng can pass user-supplied input as a format string parameter to syslog() calls
- Vendor Information Help Date Notified:
- Statement Date:
- Date Updated: 05 Dec 2000
Patrick Powell is the author responsible for development of this version of LPRng.
Extract from CHANGES in LPRng-3.6.25 distribution at:
Release LPRng 3.6.25 Tue Oct 3 09:19:11 PDT 2000
syslog Compromise -
modified syslog to use 'syslog(xx,"%s", msg).
gettext Compromise -
added the following to Initialize():
if( getuid() == 0 || geteuid() == 0 ) unsetenv("NLSPATH");
See the various CERT advisories. Sigh...
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.