CVE

Id
5669  
CVE No.
CVE-2002-1285  
Status
Candidate  
Description
runlpr in the LPRng package allows the local lp user to gain root privileges via certain command line arguments.  
Phase
Proposed (20030317)  
Votes
ACCEPT(3) Armstrong, Cole, Green | MODIFY(1) Cox  
Comments
CHANGE> [Cox changed vote from REVIEWING to MODIFY] | Cox> LPRng does not contain anything called runlpr, and in fact if you | look at the packages SuSE say that they ship as part of the erratum they | don"t even provide updated LPRng packages. However they do ship lprfilter | packages and looking inside them I find that they are what contain this | runlpr program: | | http://at.rpmfind.net/opsys/linux/RPM/suse.com/i386/update/8.0/ap1/lpdfilter-0.42-155.i386.html | | This states that lpdfilter is a collection of scripts written by SuSE, and | the changelog even highlights this is where the security fix was made. | Therefore I believe that the CVE reference and all the descriptions of | this vulnerability, which are based on a bad advisory description from | SuSE, are also wrong, it should be: | | "runlpr from the SuSE lpdfilter package allows the local lp user to gain | root privileges via certain command line arguments."  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
31212 5669 CVE-2002-1285 SUSE:SuSE-SA:2002:040  View
31213 5669 CVE-2002-1285 URL:http://www.novell.com/linux/security/advisories/2002_040_lprng_html2ps.html  View
31214 5669 CVE-2002-1285 XF:lprng-runlpr-gain-privileges(10525)  View
31215 5669 CVE-2002-1285 URL:http://www.iss.net/security_center/static/10525.php  View
31216 5669 CVE-2002-1285 BID:6077  View

Related JVN