[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#262402: Severity of bug #259993

On Sun, Aug 01, 2004 at 12:05:12PM +0200, J.H.M. Dassen (Ray) wrote:

> If cups-pdf invoked on behalf of a regular user is actually run with root
> privileges (I haven't checked), then -dSAFER only alleviates the security
> problems resulting from that situation, but it certainly doesn't end them,
> as sensitive information could easily be leaked; consider a simple .ps
> program that reads a file (say /etc/shadow) and prints its contents.

Indeed.  Based on the description of the program, I do not see justification
for using root privileges.

 - mdz

Reply to: