Solaris lpset Buffer Overflow Vulnerability
BID:251
Info
Solaris lpset Buffer Overflow Vulnerability
| Bugtraq ID: | 251 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 11 1999 12:00AM |
| Updated: | May 11 1999 12:00AM |
| Credit: | This vulnerablity was reported to the BUGTRAQ mailing list by "kim yong-jun homepage=ce.hannam.ac.kr/~s96192" <[email protected]>. |
| Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 |
| Not Vulnerable: | |
Discussion
Solaris lpset Buffer Overflow Vulnerability
A stack buffer overflow vulnerability in the handling of the "-a" command in the lpset program allows arbitrary execution of code with root privileges.
The lpset utility sets printing configuration information in the system configuration databases. lpset can be used to create and update printing configuration in /etc/printers.conf or Federated Naming System (FNS). Only a superuser or a member of Group 14 may execute lpset.
There has been mixed results as to whether the applications exits with the message "Permission denied: not in group 14." before the overflow can be exploited, and thus the vulnerability can only be exploited by members of group 14.
A stack buffer overflow vulnerability in the handling of the "-a" command in the lpset program allows arbitrary execution of code with root privileges.
The lpset utility sets printing configuration information in the system configuration databases. lpset can be used to create and update printing configuration in /etc/printers.conf or Federated Naming System (FNS). Only a superuser or a member of Group 14 may execute lpset.
There has been mixed results as to whether the applications exits with the message "Permission denied: not in group 14." before the overflow can be exploited, and thus the vulnerability can only be exploited by members of group 14.
References
Solaris lpset Buffer Overflow Vulnerability
References:
References: