BID:927

Multiple Vendor lpd Vulnerabilities

Info

Multiple Vendor lpd Vulnerabilities

Bugtraq ID:	927
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 11 2000 12:00AM
Updated:	Jan 11 2000 12:00AM
Credit:	Vulnerability announced in a L0pht Advisory published on June 8, 1999.
Vulnerable:	SGI IRIX 6.5.18 m SGI IRIX 6.5.18 f SGI IRIX 6.5.17 m SGI IRIX 6.5.17 f SGI IRIX 6.5.16 m SGI IRIX 6.5.16 f SGI IRIX 6.5.15 m SGI IRIX 6.5.15 f SGI IRIX 6.5.14 m SGI IRIX 6.5.14 f SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 Redhat Linux 6.1 i386 Redhat Linux 6.0 Redhat Linux 5.2 i386 Redhat Linux 5.1 - Standard & Poors ComStock 4.2.4 Redhat Linux 5.0 Redhat Linux 4.2 Redhat Linux 4.1 Redhat Linux 4.0

Not Vulnerable:	SGI IRIX 6.5.20 SGI IRIX 6.5.19

Discussion

Multiple Vendor lpd Vulnerabilities

Multiple vulnerabilities have been discovered in lpd, shipped with various Linux and Unix distributions.

It has been reported that lpd fails to properly authenticate hostnames. This could allow an unauthenticated user to gain access to lpd services by supplying a spoofed hostname.

It is also possible for a local user to pass arguments to sendmail, through the vulnerable print daemon. This could allow an unauthorized user to execute commands with elevated privileges.

By exploiting multiple vulnerabilities in lpd, it may be possible for a remote attacker to gain root privileges on a target server.

It should be noted that this vulnerability is similar to that described in BID 3274.

Exploit / POC

Multiple Vendor lpd Vulnerabilities

An exploit has been made available.

/data/vulnerabilities/exploits/qib.tgz

Solution / Fix

Multiple Vendor lpd Vulnerabilities

Solution:
SGI has released a security advisory. The issue has been addressed in the latest version of IRIX. Fixes have also been made available.

SGI has released a new security advisory which contains a patch which addresses problems encountered in the 4835 patch. Users are advised to apply the newly available patch as soon as possible.

Download the fix from RedHat at:

Red Hat Linux 6.x:

Intel:
ftp://updates.redhat.com/6.1/i386/lpr-0.48-1.i386.rpm

Alpha:
ftp://updates.redhat.com/6.1/alpha/lpr-0.48-1.alpha.rpm

Sparc:
ftp://updates.redhat.com/6.1/sparc/lpr-0.48-1.sparc.rpm

Source packages:
ftp://updates.redhat.com/6.1/SRPMS/lpr-0.48-1.src.rpm

Red Hat Linux 5.x:

Intel:
ftp://updates.redhat.com/5.2/i386/lpr-0.48-0.5.2.i386.rpm

Alpha:
ftp://updates.redhat.com/5.2/alpha/lpr-0.48-0.5.2.alpha.rpm

Sparc:
ftp://updates.redhat.com/5.2/sparc/lpr-0.48-0.5.2.sparc.rpm

Source packages:
ftp://updates.redhat.com/5.2/SRPMS/lpr-0.48-0.5.2.src.rpm

Red Hat Linux 4.x:

Intel:
ftp://updates.redhat.com/4.2/i386/lpr-0.48-0.4.2.i386.rpm

Alpha:
ftp://updates.redhat.com/4.2/alpha/lpr-0.48-0.4.2.alpha.rpm

Sparc:
ftp://updates.redhat.com/4.2/sparc/lpr-0.48-0.4.2.sparc.rpm

Source packages:
ftp://updates.redhat.com/4.2/SRPMS/lpr-0.48-0.4.2.src.rpm

SGI IRIX 6.5