Hummingbird Connectivity 10 LPD Daemon Stack Overflow Vulnerability

Bugtraq ID:	13788
Class:	Boundary Condition Error
CVE:	CVE-2005-1815
Remote:	Yes
Local:	No
Published:	May 27 2005 12:00AM
Updated:	Feb 01 2008 06:47PM
Credit:	Discovery of this issue is credited to Ollie Whitehouse of Symantec.
Vulnerable:	Hummingbird Connectivity 10.0 Hummingbird Connectivity 9.0 Hummingbird Connectivity 7.1
Not Vulnerable:

Hummingbird Connectivity 10 LPD Daemon Stack Overflow Vulnerability

Hummingbird Connectivity 10 LPD daemon is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform sufficient boundary checks on user-supplied data.

A successful exploit will allow an unauthenticated attacker to obtain SYSTEM-level access to a vulnerable computer.

Hummingbird Connectivity 10 LPD Daemon Stack Overflow Vulnerability

The following exploit code is available as a module for the Metasploit Framework:

• /data/vulnerabilities/exploits/13788-hummingbird_exceed.rb

Hummingbird Connectivity 10 LPD Daemon Stack Overflow Vulnerability

Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the referenced advisory for more information.


Hummingbird Connectivity 10.0

• Hummingbird lpdw_10001.zip
  http://support.hummingbird.com/customer/download.asp?r2=/exceed/10/lpd w_10001.zip

Hummingbird Connectivity 9.0

• Hummingbird lpdw_9001.zip
  http://support.hummingbird.com/customer/download.asp?r2=/exceed/900/lp dw_9001.zip

Hummingbird Connectivity 10 LPD Daemon Stack Overflow Vulnerability

References:

• Connectivity Home Page (Hummingbird LTD.)
  
• LPD Security Advisory Patch (Hummingbird LTD.)