Solaris LpNet temp file Vulnerability

Bugtraq ID:	441
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	May 03 1997 12:00AM
Updated:	May 03 1997 12:00AM
Credit:	First posted to BugTraq by Chris Sheldon <[email protected]> on May 3, 1997. Followup posted to BugTraq by Casper Dik <[email protected]> on May 7, 1997.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4
Not Vulnerable:

Solaris LpNet temp file Vulnerability

Remote printing to the local spool causes a temp file to be created mode 666 owned by lp in /var/tmp. This can be used in conjunction with /var/lp/logs/lpsched, which is another temp file created mode 666 owned by root, to break root by first symlinking to /usr/spool/lp/.rhosts, becoming lp, symlinking to /.rhosts and, as lp, using /usr/sbin/lpshut to cause /.rhosts to be created mode 666 owned by root.

Solaris LpNet temp file Vulnerability

x

• /data/vulnerabilities/exploits/lpnet.sh

Solaris LpNet temp file Vulnerability

Solution:
add "umask 022" to /etc/init.d/lp; restart /etc/init.d/lp

su - root; touch /usr/spool/lp/.rhosts

su - root; chown root /usr/spool/lp; chmod 755 /usr/spool/lp

Or a less extreme fix,

echo 'Options: PRINTER * = -L/var/lp/*.log' | lpfilter -f postio -
echo 'Options: PRINTER * = -L/var/lp/*.log' | lpfilter -f postior -

Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.4_x86

• Sun 101960-14
  

Sun Solaris 2.5

• Sun 102964-08
  

Sun Solaris 2.4

• Sun 101959-14
  

Sun Solaris 2.5_x86

• Sun 102965-08
  

Sun Solaris 2.5.1 _x86

• Sun 103960-05
  

Sun Solaris 2.5.1

• Sun 103959-05
  

Solaris LpNet temp file Vulnerability

References: