Re: Possible weakness in LPD protocol

[perhaps () YES NO (Eivind Eklund)]

> On October 02 1997, Bennett Samowich wrote:
>
> > 1.) Obtaining hard (or possibly soft) copies of any file on the system.
> > 2.) Deleting any file on the system.
> > 3.) Creating a file on the system.
> > 4.) Mail bombing.
>
> 5.) Overflow at least one buffer from the network; this is just
> above the "print any file" part of recvjob.c:
>
>                 cp = line;
>                 do {
>                         if ((size = read(1, cp, 1)) != 1) {
>                                 if (size < 0)
>                                         frecverr("%s: Lost connection",printer);
>                                 return(nfiles);
>                         }
>                 } while (*cp++ != '\n');
>
>
> Consequences aren't really obvious, but you may be able to do
> nasty things.
>
> Will we ever get rid of gets()?  (lpd source tree is from some
> recent RedHat distribution.)

This is fixed in OpenBSD and FreeBSD.  Linux people should learn to
track what others do ;-)

The problems with '/' in filenames is fixed, too.  The mail-bombing
might still be an issue, but there are lots of other ways to do that,
so I don't really think it warrants our attention (besides which I
can't see any way to fix it).

Eivind.