Date: Mon, 30 Jun 2014 21:14:55 -0400
From: Rich Felker <dalias@libc.org>
To: musl@lists.openwall.com
Cc: alpine-devel@lists.alpinelinux.org
Subject: [alpine-devel] Re: [musl] Re: cups debugging, continued...ugly patch
Message-ID: <20140701011455.GI179@brightrain.aerifal.cx>
References: <20140629194829.GA1994@newbook>
 <20140630001201.GA14838@newbook>
 <20140630012830.GA16088@newbook>
 <20140630020311.GD179@brightrain.aerifal.cx>
 <20140630043512.GB16088@newbook>
 <20140630053426.GC16088@newbook>
 <20140630070353.GG179@brightrain.aerifal.cx>
 <m3zjgurxmx.fsf@carbon.jhcloos.org>
Precedence: list
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <m3zjgurxmx.fsf@carbon.jhcloos.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: Rich Felker <dalias@aerifal.cx>

On Mon, Jun 30, 2014 at 03:43:25PM -0400, James Cloos wrote:
> >>>>> "RF" == Rich Felker <dalias@libc.org> writes:
> 
> RF> Of course binding a reserved port like this is a serious security
> RF> smell -- it sounds like they're trying to facilitate port-based
> RF> authentication, which is unsafe if used for anything except localhost.
> 
> If it is for the lpd protocol, there are (or at least have been) systems
> and printers which only accepted print jobs via lpd if they originated
> on the lpd port.  Or maybe it was if they originated on a <1024 port.
> 
> I have a vague recollection of bug reports for cups in the early days
> about that.  

Yes, this sounds plausible, but those print servers/printers are
highly insecure already and should really be fixed to use proper
authentication.

It's also something of an issue that cups lpd even has permissions to
bind reserved ports for outgoing connections, since this means it is
retaining root permissions past startup...

Rich


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---