|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-1270: lppasswd might corrupt cups passwd file | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Ludwig Nussel <lnussel> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | heiko.rommel, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-1270: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | 63.c | ||
|
Description
Ludwig Nussel
2004-12-17 20:19:03 UTC
Created attachment 27214 [details]
63.c
can be handled after xmas break. ====================================================== Candidate: CAN-2004-1268 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1268 Reference: MISC:http://tigger.uic.edu/~jlongs2/holes/cups2.txt lppasswd in CUPS 1.1.22 ignores write errors when modifying the CUPS passwd file, which allows local users to corrupt the file by filling the associated file system and triggering the write errors. ====================================================== Candidate: CAN-2004-1269 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1269 Reference: MISC:http://tigger.uic.edu/~jlongs2/holes/cups2.txt lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail. ====================================================== Candidate: CAN-2004-1270 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1270 Reference: MISC:http://tigger.uic.edu/~jlongs2/holes/cups2.txt lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message. Fixed in: 8.1 (UL1, NLD, SLES8), 8.2, 9.0, 9.1 Not affected: 9.2 and new packages submitted. Not much tested. security-team please handle rest of update process ==> reassigning it `patchinfo-box.cups' -> `/work/src/done/PATCHINFO/patchinfo-box.cups' `patchinfo-9.2.cups' -> `/work/src/done/PATCHINFO/patchinfo-9.2.cups' `patchinfo.cups' -> `/work/src/done/PATCHINFO/patchinfo.cups' as root lppasswd -a tux <enter password twice> as tux: ./63 <enter old password> <enter new password twice> ls -la /etc/cups/passwd.new exists lppasswd <enter old password> <enter new password twice> lppasswd: Password file busy! The last message should not appear after the update, /etc/cups/passwd.new should not exist. the fix is broken. if no /etc/cups/passwd.* is there, lppasswd -a tux does not work. # lppasswd -a tux Enter password: Enter password again: lppasswd: failed to backup old password file: No such file or directory # Cannot reproduce. :( # rm /etc/cups/passwd.* # lppasswd -a klaus Enter password: Enter password again: # ll /etc/cups/passwd.* 4 -r-------- 1 lp root 43 Jan 27 11:40 /etc/cups/passwd.md5 I tried patches with a SuLi 9.2-i386 (hostname: lavoisier.suse.de) Whats your setup? happens for instance on sles9 , feel free to use sles9-ppc host "grape". fixed problem and checked problem. submitted new packages. security-team please handle rest of update process ==> reassigning it. already submitted fixed patchinfos. packages approved CVE-2004-1270: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N) |