Re: LPRng/rhs-printfilters - remote execution of commands

[Matt Bing <mbing () nfr net>]

> RedHat 7.0 (possibly others)

Redhat 7.1 is not vulnerable. If tetex-dvips is installed, the filter
/usr/share/printconf/mf_rules/mf40-tetex_filters contains the '-R' 
switch:

#
# tetex filters
#

/dvi/  fpipe/postscript/       /usr/bin/dvips -t PAGEsize ifdef(`XDPI',-X XDPI -Y YDPI, ifdef(`DPI',-D DPI,-D 600)) -R 
-q -f $FILE

-- 
Matt Bing
NFR Security
Rapid Response Team