Title: LPRNG LPRNG_CERTS.SH Local Insecure Temporary File Creation Vulnerability
Severity: MODERATE
Description:
The LPRng software is an extended and portable implementation of the Berkeley LPR print spooler. It supports the standard LPR interface, however it also supports expanded functionality. It is freely available for Unix and Unix variant operating systems.
A temporary file creation vulnerability reportedly affects the 'lprng_certs.sh' script of LPRng. This issue is due to a design error that causes the affected application to insecurely create files on affected computers.
The problem presents itself when the affected application fails to register the existence of files that are temporarily created to aid in the file conversion process. This will cause the application to write to any symbolic links that exist when writing to temporary files.
An attacker may leverage this issue to corrupt arbitrary files with the privileges of an unsuspecting user that activates the affected application.
Although only version 3.8.28 is reportedly affected, other versions are likely to be affected as well.
Affected Products:
- AStArt Technologies LPRng 3.8.28
References:
- AStArt Technologies: LPRng Web Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
