BID:4980

LPRNG Remote Print Submission Vulnerability

Info

LPRNG Remote Print Submission Vulnerability

Bugtraq ID:	4980
Class:	Configuration Error
CVE:	CVE-2002-0378
Remote:	Yes
Local:	No
Published:	Jun 10 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Discovery credited to Matthew Caron.
Vulnerable:	Patrick Powell LPRng 3.8.9 - Redhat Linux 7.3 Patrick Powell LPRng 3.7.4 - HP Secure OS software for Linux 1.0 - Mandriva Linux Mandrake 8.2 - Mandriva Linux Mandrake 8.1 - Redhat Linux 7.2 - Redhat Linux 7.1 - Redhat Linux 7.0 Patrick Powell LPRng 3.6.20 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.19 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.18 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.17 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.16 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.15 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.14 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.13 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.12 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.11 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.10 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.9 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.8 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.7 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.6 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.5 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.4 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.3 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.2 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 Patrick Powell LPRng 3.6.1 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 5.3 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0

Not Vulnerable:

Discussion

LPRNG Remote Print Submission Vulnerability

The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality.

Default configurations of LPRng accept all remote print submissions to the print queue. A malicious attacker may be able to submit many print requests to the existing print queue.

Exploit / POC

LPRNG Remote Print Submission Vulnerability

There is no exploit code required.

Solution / Fix

LPRNG Remote Print Submission Vulnerability

Solution:
HP has advised applying the appropriate fixes made available in Red Hat Advisory RHSA-2002:089.

RedHat has issued an advisory with detailed upgrading instructions. Updated packages are available.

Mandrake has issued an advisory. Customers are advised to upgrade to the latest packages.

Patrick Powell LPRng 3.7.4

MandrakeSoft LPRng-3.7.4-7.1mdk.i586.rpm
Mandrake Linux 8.1.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.7.4-7.1mdk.ia64.rpm
Mandrake Linux 8.1 ia64.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.7.4-7.1mdk.src.rpm
Mandrake Linux 8.1 i586 source RPM.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.7.4-7.1mdk.src.rpm
Mandrake Linux 8.1 ia64 source RPM.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.8.6-2.1mdk.i586.rpm
Mandrake Linux 8.2 i586.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.8.6-2.1mdk.ppc.rpm
Mandrake Linux 8.2 PPC.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.8.6-2.1mdk.src.rpm
Mandrake Linux 8.2 i586 source RPM.
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft LPRng-3.8.6-2.1mdk.src.rpm
Mandrake Linux 8.2 PPC source RPM.
http://www.mandrakesecure.net/en/ftp.php

Red Hat LPRng-3.7.4-23.1.alpha.rpm
Red Hat Linux 7.0 Alpha.
ftp://updates.redhat.com/7.0/en/os/alpha/LPRng-3.7.4-23.1.alpha.rpm

Red Hat LPRng-3.7.4-23.1.alpha.rpm
Red Hat Linux 7.1 Alpha.
ftp://updates.redhat.com/7.1/en/os/alpha/LPRng-3.7.4-23.1.alpha.rpm

Red Hat LPRng-3.7.4-23.1.i386.rpm
Red Hat Linux 7.0 i386.
ftp://updates.redhat.com/7.0/en/os/i386/LPRng-3.7.4-23.1.i386.rpm

Red Hat LPRng-3.7.4-23.1.i386.rpm
Red Hat Linux 7.1 i386.
ftp://updates.redhat.com/7.1/en/os/i386/LPRng-3.7.4-23.1.i386.rpm

Red Hat LPRng-3.7.4-23.1.ia64.rpm
Red Hat Linux 7.1 ia64.
ftp://updates.redhat.com/7.1/en/os/ia64/LPRng-3.7.4-23.1.ia64.rpm

Red Hat LPRng-3.7.4-23.1.src.rpm
Source RPM.
ftp://updates.redhat.com/7.0/en/os/SRPMS/LPRng-3.7.4-23.1.src.rpm

Red Hat LPRng-3.7.4-23.1.src.rpm
Red Hat Linux 7.1 source RPM.
ftp://updates.redhat.com/7.1/en/os/SRPMS/LPRng-3.7.4-23.1.src.rpm

Red Hat LPRng-3.7.4-28.1.i386.rpm
Red Hat Linux 7.2 i386.
ftp://updates.redhat.com/7.2/en/os/i386/LPRng-3.7.4-28.1.i386.rpm

Red Hat LPRng-3.7.4-28.1.ia64.rpm
Red Hat Linux 7.2 ia64.
ftp://updates.redhat.com/7.2/en/os/ia64/LPRng-3.7.4-28.1.ia64.rpm

Red Hat LPRng-3.7.4-28.1.src.rpm
Red Hat Linux 7.2 source RPM.
ftp://updates.redhat.com/7.2/en/os/SRPMS/LPRng-3.7.4-28.1.src.rpm

Red Hat LPRng-3.8.9-4.i386.rpm
Red Hat Linux 7.3 i386.
ftp://updates.redhat.com/7.3/en/os/i386/LPRng-3.8.9-4.i386.rpm

Red Hat LPRng-3.8.9-4.src.rpm
Red Hat Linux 7.3 source RPM.
ftp://updates.redhat.com/7.3/en/os/SRPMS/LPRng-3.8.9-4.src.rpm

Patrick Powell LPRng 3.8.9

Red Hat LPRng-3.8.9-4.i386.rpm
Red Hat Linux 7.3 i386.
ftp://updates.redhat.com/7.3/en/os/i386/LPRng-3.8.9-4.i386.rpm

Red Hat LPRng-3.8.9-4.src.rpm
Red Hat Linux 7.3 source RPM.
ftp://updates.redhat.com/7.3/en/os/SRPMS/LPRng-3.8.9-4.src.rpm