mailing list archives
potential buffer overflow in lprm (fwd)
From: Dave Ahmad <da () securityfocus com>
Date: Wed, 5 Mar 2003 15:33:25 -0700 (MST)
David Mirza Ahmad
"sabbe dhamma anatta"
8D 9A B1 33 82 3D B3 D0 40 EB AB F0 1E 67 C6 1A 26 00 57 12
--- Begin Message ---
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Wed, 05 Mar 2003 15:26:22 -0700
A bounds check that was added to lprm in 1996 does its checking too
late to be effective. Because of the insufficient check, it may
be possible for a local user to exploit lprm to gain elevated
privileges. It is not know at this time whether or not the bug is
Starting with OpenBSD 3.2, lprm is setuid user daemon which limits
the impact of the bug. OpenBSD 3.1 and below however, ship with
lprm setuid root so this is a potential localhost root hole on older
versions of OpenBSD.
The bug is fixed in OpenBSD-current as well as the 3.2 and 3.1
Patch for OpenBSD 3.1:
Patch for OpenBSD 3.2:
Thanks go to Arne Woerner for noticing this bug.
--- End Message ---
- potential buffer overflow in lprm (fwd) Dave Ahmad (Mar 05)