Gentoo: lprng Symlink attack
Posted by LinuxSecurity.com Team   
Gentoo psbanner in the LPRng package allows local users to overwrite arbitraryfiles via a symbolic link attack on the /tmp/before file.

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200306-04
- - ---------------------------------------------------------------------

          PACKAGE : lprng
          SUMMARY : symbolic link attack
             DATE : 2003-06-14 15:35 UTC
          EXPLOIT : local
VERSIONS AFFECTED : =lprng-3.8.12-r1
              CVE : CAN-2003-0136

- - ---------------------------------------------------------------------

psbanner in the LPRng package allows local users to overwrite arbitrary
files via a symbolic link attack on the /tmp/before file.

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-print/lprng upgrade to lprng-3.8.12-r1 as follows

emerge sync
emerge lprng
emerge clean

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at  http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------