a2ps 4.13 - security issue

[K. K. Tam]

Hi,

I've learned from SUN security alerts (ID 57649) that a2ps has a 
filename vulnerability that may allow a local unprivileged user to 
execute arbitrary code.  I wonder if this is correct for version 4.13.  
If yes, will you release a patch on the sources (v4.13 or v4.13b) soon?

We have a port on Solaris 9 from sources of version 4.13.  Lately we 
have one of the system being compromised and suspect "a2ps" might be one 
of the plausible cause after reviewing all relevant operating system 
patches.

Thanks in advance.


Regards,
K. K. Tam
Information Technology Services Center
Hong Kong University of Science & Technology