Solaris lp -d Option Buffer Overflow Vulnerability

Bugtraq ID:	1143
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Apr 24 2000 12:00AM
Updated:	Apr 24 2000 12:00AM
Credit:	This vulnerability was posted to the Bugtraq mailing list by Theodor Ragnar Gislason <[email protected]> on April 24, 2000.
Vulnerable:	Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:	Sun Solaris 8_x86 Sun Solaris 8_sparc

Solaris lp -d Option Buffer Overflow Vulnerability

A buffer overrun has been discovered in the lp program, as included with Sun's Solaris 7 operating system. By passing well crafted, machine executable code of sufficient length to the -d option of lp, it becomes possible to execute arbitrary code as root.

Solaris lp -d Option Buffer Overflow Vulnerability

An exploit has been made available.

• /data/vulnerabilities/exploits/lp-solaris7-of-x86.c

Solaris lp -d Option Buffer Overflow Vulnerability

Solution:
Removal of the setuid bit will eliminate this vulnerability, but will prevent printing from working properly.


Sun Solaris 7.0_x86

• Sun 107116-05
  http://sunsolve.sun.com/pub-cgi/patchDownload.pl?target=107116&method= F

Sun Solaris 2.6

• Sun 106235-06
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106235-06-1

Sun Solaris 7.0

• Sun 107115-05
  http://sunsolve.sun.com/pub-cgi/patchDownload.pl?target=107115&method= F

Sun Solaris 2.6_x86

• Sun 106236-06
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106236-06-1

Solaris lp -d Option Buffer Overflow Vulnerability

References: