Original issue date: June 25, 1997<BR>
Last revised: April 7, 1998<BR>
Added vendor information for Silicon Graphics Inc.

<P>A complete revision history is at the end of this file.

<P>The technical content of this advisory was originally published by
AUSCERT (AA-96.12), who last updated the information on June 19, 1997.
We use it here with their permission.


<P>There is a vulnerability in the BSD-based printing software, lpr,
available on a variety of Unix platforms. This vulnerability may allow
local users to gain root privileges.

<P>Exploit information involving this vulnerability has been publicly
available for some time. Recently, the CERT/CC has received reports
that the vulnerability is being actively exploited.

<P>We recommend installing a vendor patch if one is available. Until you
can do so, we recommend using the wrapper described in Section III.B.

<P>We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.

<H2>I. Description</H2>
A vulnerability exists in the BSD-based lpr printing package found on many
Unix systems.

<P>Due to insufficient bounds checking on arguments that are supplied by
users, it is possible to overwrite the internal stack space of the lpr
program while it is executing. This can allow an intruder to cause lpr
to execute arbitrary commands by supplying a carefully designed argument
to lpr. These commands will be run with the privileges of the lpr program.
When lpr is installed setuid or setgid, it may allow intruders to gain
those privileges.

<P>When lpr is setuid root, it may allow intruders to run arbitrary commands
with root privileges.

<P>For information from vendors relating to this vulnerability, please
check Appendix A of this advisory. In addition to the products mentioned,
be aware that platforms using the BSD-based lpr systems, in which lpr is
installed setuid or setgid, may also be vulnerable.

<P>Note also that the vulnerability described in this advisory is not present
in the LPRng printing package.
<H2>II. Impact</H2>
Local users may gain root privileges. It is necessary to have access to
an account on the system to exploit this vulnerability.
<H2>III. Solution</H2>
The lpr printing package is available on many different systems. As vendor
patches are made available sites are encouraged to install them. Until
vendor patches are available, we recommend applying the workaround referred
to in III.B.
<H3>A. Install vendor patches</H3>
Specific vendor information has been placed in Appendix A. If the BSD-
based lpr printing software is used and your vendor is not listed in Appendix
A, please contact your vendor directly.
<H3>B. Install lpr wrapper</H3>
Until you can install a vendor patch, we encourage you install a wrapper
developed by AUSCERT to help prevent lpr being exploited using this vulnerability.

<P>The source for the wrapper, including installation instructions, can
be found at

<P><A HREF="ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c">ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c</A>

<P>This wrapper replaces the lpr program and checks the length of the command
line arguments which are passed to it. If an argument exceeds a certain
predefined value (MAXARGLEN), the wrapper exits without executing the lpr
command. The wrapper program can also be configured to syslog any failed
attempts to execute lpr with arguments exceeding MAXARGLEN. For further
instructions on using this wrapper, please read the comments at the top
of overflow_wrapper.c.

<P>When compiling overflow_wrapper.c for use with lpr, AUSCERT recommends
defining MAXARGLEN to be 32.

<P>The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from

<P><A HREF="ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM">ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM</A>

<P>The CHECKSUM file has been digitally signed using the AUSCERT PGP key.

<H2>Appendix A - Vendor information</H2>
Below is a list of the vendors who have provided information. We will update
this appendix as we receive additional information. If you do not see your
vendor's name, please contact the vendor directly.
<H3>Berkeley Software Design, Inc. (BSDI)</H3>
BSD/OS 3.0 is not vulnerable to the problem.

<P>BSDI have issued a patch which addresses this vulnerability under BSD/OS
2.1. This patch is available from:

<P><A HREF="ftp://ftp.bsdi.com/pub/bsdi/patches/patches-2.1/U210-028">ftp://ftp.bsdi.com/pub/bsdi/patches/patches-2.1/U210-028</A>
<H3>Digital Equipment Corporation</H3>
Digital Equipment Corporation
<BR>Software Security Response Team
<BR>Copyright (c) Digital Equipment Corporation 1997. All rights reserved.

<P>This reported problem is not present for Digital's ULTRIX or Digital
UNIX Operating Systems Software.

This problem was fixed prior to the release of FreeBSD 2.1.6 and 2.2. Users
running older versions of the OS should review the security advisory describing
this vulnerability (SA-96.18) at:

<P><A HREF="ftp://freebsd.org/pub/CERT/advisories/FreeBSD-SA-96:18.lpr.asc">ftp://freebsd.org/pub/CERT/advisories/FreeBSD-SA-96:18.lpr.asc</A>

<P>Patches can be found in the directory:

<P><A HREF="ftp://freebsd.org/pub/CERT/patches/SA-96:18">ftp://freebsd.org/pub/CERT/patches/SA-96:18</A>
<H3>IBM Corporation</H3>
AIX is not vulnerable to the lpr buffer overflow. The version of lpr shipped
with AIX is not installed with the setuid bit turned on.

<P>IBM and AIX are registered trademarks of International Business Machines
The Linux Emergency Response Team have released a Linux Security FAQ Update
which addresses this vulnerability. This Update contains information regarding
various Linux distributions.

<P>It is available from:

<P><A HREF="ftp://bach.cis.temple.edu/pub/Linux/Security/FAQ/updates/Update-11-25-1996.vulnerability-lpr-0.06-v1.2">ftp://bach.cis.temple.edu/pub/Linux/Security/FAQ/updates/Update-11-25-1996.vulnerability-lpr-0.06-v1.2</A>

<H3>NCR Corporation</H3>

<P>The lpr command is not installed as a set-uid command on NCR MP-RAS
Unix SVR4 systems, which means MP-RAS is not vulnerable.

The NEXT group has addressed the vulnerability described in this advisory
in release 4.2 of OpenStep/Mach.

<H3>The Santa Cruz Operation, Inc. (SCO)</H3>
SCO has determined that the following SCO operating systems are not vulnerable:

<P>- SCO CMW+ 3.0
<BR>- SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
<BR>- SCO OpenServer 5.0
<BR>- SCO UnixWare 2.1

<H3>Silicon Graphics Inc.</H3>

For patch information, see Silicon Graphics Inc. Security Advisory,
Number 19980402-01-PX, "lp(1) Security Vulnerabilities," available

<P><A HREF="ftp://sgigate.sgi.com/security/19980402-01-PX">ftp://sgigate.sgi.com/security/19980402-01-PX</A>

<H3>Sun Microsystems, Inc.</H3>
All versions of Solaris are not affected. SunOS 4.1.3_U1 and SunOS 4.1.4
are vulnerable. Sun recommends that sites using SunOS 4.1.3_U1 and SunOS
4.1.4 apply the workaround provided in this advisory.


<P>The CERT Coordination Center staff thanks AUSCERT for permission to
republish the information in their advisory AA-96.12. AUSCERT originally
thanked Alexander O. Yuriev, the FreeBSD security team, IBM, and the CERT/CC
for their assistance in the production of their advisory.


<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 1997 Carnegie Mellon University.</P>


Revision History
Apr.  7, 1998   Added vendor information for Silicon Graphics Inc.
Dec.  5, 1997   Added vendor information for NCR Corporation.
Sep. 30, 1997  Updated copyright statement