Debian Security Advisory DSA 524-1 (rlpr)

Summary
The remote host is missing an update to rlpr announced via advisory DSA 524-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20524-1
Insight
jaguar@felinemenace.org discovered a format string vulnerability in rlpr, a utility for lpd printing without using /etc/printcap. While investigating this vulnerability, a buffer overflow was also discovered in related code. By exploiting one of these vulnerabilities, a local or remote user could potentially cause arbitrary code to be executed with the privileges of 1) the rlprd process (remote), or 2) root (local). CVE-2004-0393: format string vulnerability via syslog(3) in msg() function in rlpr CVE-2004-0454: buffer overflow in msg() function in rlpr For the current stable distribution (woody), this problem has been fixed in version 2.02-7woody1. For the unstable distribution (sid), this problem will be fixed soon. We recommend that you update your rlpr package.