LPRng Print Queue Control Vulnerability
BID:508
Info
LPRng Print Queue Control Vulnerability
| Bugtraq ID: | 508 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Yes |
| Published: | Jul 02 1999 12:00AM |
| Updated: | Jul 02 1999 12:00AM |
| Credit: | First posted to BugTraq by Chris Leishman <[email protected]> on July 2, 1999. |
| Vulnerable: |
Debian Linux 2.1 Debian Linux 2.0 r5 Debian Linux 2.0 |
| Not Vulnerable: | |
Discussion
LPRng Print Queue Control Vulnerability
The LPRng software is an enhanced, extended, and portable version of the Berkeley LPR software (the standard UNIX printer spooler) that ships with Debian GNU/Linux. When root controls the print queue, the authentication that is used is based on whether the client source port connecting to lpd is privileged or not. Apparently, lpd does not check the source port properly, and it is possible for any local user to control the print queue with a modified client. The consequences of this vulnerability being exploited is a compromise of print queue control.
The LPRng software is an enhanced, extended, and portable version of the Berkeley LPR software (the standard UNIX printer spooler) that ships with Debian GNU/Linux. When root controls the print queue, the authentication that is used is based on whether the client source port connecting to lpd is privileged or not. Apparently, lpd does not check the source port properly, and it is possible for any local user to control the print queue with a modified client. The consequences of this vulnerability being exploited is a compromise of print queue control.
Exploit / POC
Solution / Fix
LPRng Print Queue Control Vulnerability
Solution:
In a post to BugTraq, the maintainer of LPRng, Patrick Powell, presented a temporary fix by enabling the security features. This configuration fix makes LPRng check source ports and will be setup by default upon next release. The author did stress that this was not a complete fix and that the problem lied in the protocol.
# check originating ports on connections
REJECT SERVICE=X NOT PORT=721-731
Add the above line to /etc/lpd.conf.
Solution:
In a post to BugTraq, the maintainer of LPRng, Patrick Powell, presented a temporary fix by enabling the security features. This configuration fix makes LPRng check source ports and will be setup by default upon next release. The author did stress that this was not a complete fix and that the problem lied in the protocol.
# check originating ports on connections
REJECT SERVICE=X NOT PORT=721-731
Add the above line to /etc/lpd.conf.
References
LPRng Print Queue Control Vulnerability
References:
References:
- Debian LPRng Package Reference (Debian GNU/Linux)