Security hole in Flex/IP

Thread View: comp.os.netware.misc

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by A. Grant Thu, 03 Aug 1995 00:00

#605

Author: A. Grant
Date: Thu, 03 Aug 1995 00:00

15 lines
1349 bytes

There appears to be a security hole in Unix-to-NetWare printing
with Flex/IP.  The problem is that Flex/IP's LPD server fails to
check whether the sender is using a reserved port.  So, if you
are printing from, say, a Unix timesharing system that you have
set up to Flex/IP as a trusted host, unprivileged users on that
system can set up connections to Flex/IP and send whatever they
like, in particular they can pretend to be other users (Flex/IP
does not do any ident() checking either).

This allows users to bypass any queue protection and printer
accounting on the Novell server.

I would recommend only making 'trusted hosts' those hosts which
are entirely trusted and not simply those whose reserved ports 
are trusted as you would do when setting up a normal LPD server.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads