Original release date: November 05, 2001<BR> Last revised: November 15, 2001<BR> Source: CERT/CC<BR> <P>A complete revision history can be found at the end of this file. <A NAME="affected"> <H3>Systems Affected</H3> <UL> <LI>BSDi BSD/OS Version 4.1 and earlier </LI> <LI>Debian GNU/Linux 2.1 and 2.1r4 </LI> <LI>All released versions of FreeBSD 3.x and 4.x prior to 4.4-RELEASE; FreeBSD 4.3-STABLE and 3.5.1-STABLE prior to the correction date.</LI> <LI>Hewlett-Packard HP9000 Series 700/800 running HP-UX releases 10.01, 10.10, 10.20, 11.00, and 11.11 </LI> <LI>IBM AIX Versions 4.3 and AIX 5.1 </LI> <LI>Mandrake Linux Versions 6.0, 6.1, 7.0, 7.1 </LI> <LI>NetBSD 1.5.2 and earlier </LI> <LI>OpenBSD Version 2.9 and earlier </LI> <LI>Red Hat Linux 6.0, 6.2 all architectures </LI> <LI>SCO OpenServer Version 5.0.6a and earlier </LI> <LI>SGI IRIX 6.5-6.5.13 </LI> <LI>Sun Solaris 8 and earlier </LI> <LI>SuSE Linux Versions 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2 </LI> </UL> <A NAME="overview"> <H2>Overview</H2> <P>There are multiple vulnerabilities in several implementations of the line printer daemon (lpd). The line printer daemon enables various clients to share printers over a network. Review your configuration to be sure you have applied all relevant patches. We also encourage you to restrict access to the lpd service to only authorized users. <A NAME="description"> <H2>I. Description</H2> <P>There are multiple vulnerabilities in several implementations of the line printer daemon (lpd), affecting several systems. Some of these problems have been publicly disclosed previously. However, we believe many system and network administrators may have overlooked one or more of these vulnerabilities. We are issuing this document primarily to encourage system and network administators to check their systems for exposure to each of these vulnerabilities, even if they have addressed some lpd vulnerabilities recently. <p>Most of these vulnerabilities are buffer overflows allowing a remote intruder to gain root access to the lpd server. For the latest and most detailed information about the known vulnerabilities, please see the vulnerability notes linked to below. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/274043">VU#274043</a> - BSD line printer daemon buffer overflow in displayq()</b> <br> <br> There is a buffer overflow in several implementations of in.lpd, a BSD line printer daemon. An intruder can send a specially crafted print job to the target and then request a display of the print queue to trigger the buffer overflow. The intruder may be able use this overflow to execute arbitrary commands on the system with superuser privileges. <br><br> The line printer daemon must be enabled and configured properly in order for an intruder to exploit this vulnerability. This is, however, trivial as the line printer daemon is commonly enabled to provide printing functionality. In order to exploit the buffer overflow, the intruder must launch his attack from a system that is listed in the "/etc/hosts.equiv" or "/etc/hosts.lpd" file of the target system. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/388183">VU#388183</a> - IBM AIX line printer daemon buffer overflow in kill_print()</b> <br> <br> A buffer overflow exists in the kill_print() function of the line printer daemon (lpd) on AIX systems. An intruder could exploit this vulnerability to obtain root privileges or cause a denial of service (DoS). The intruder would need to be listed in the victim's /etc/hosts.lpd or /etc/hosts.equiv file, however, to exploit this vulnerability. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/722143">VU#722143</a> - IBM AIX line printer daemon buffer overflow in send_status()</b> <br> <br> A buffer overflow exists in the send_status() function of the line printer daemon (lpd) on AIX systems. An intruder could exploit this vulnerability to obtain root privileges or cause a denial of service (DoS). The intruder would need to be listed in the victim's /etc/hosts.lpd or /etc/hosts.equiv file, however, to exploit this vulnerability. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/466239">VU#466239</a> - IBM AIX line printer daemon buffer overflow in chk_fhost()</b> <br> <br> A buffer overflow exists in the chk_fhost() function of the line printer daemon (lpd) on AIX systems. An intruder could exploit this vulnerability to obtain root privileges or cause a denial of service (DoS). The intruder would need control of the DNS server to exploit this vulnerability. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/39001">VU#39001</a> - line printer daemon allows options to be passed to sendmail</b> <br> <br> There exists a vulnerability in the line printer daemon that permits an intruder to send options to sendmail. These options could be used to specify another configuration file, allowing an intruder to gain root access. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/30308">VU#30308</a> - line printer daemon hostname authentication bypassed with spoofed DNS</b> <br> <br> A vulnerability exists in the line printer daemon (lpd) shipped with the printer package for several systems. The authentication method was not thorough enough. If a remote user was able to control their own DNS so that their IP address resolved to the hostname of the print server, access would be granted when it should not be. <br> <br> <b><a href="http://www.kb.cert.org/vuls/id/966075">VU#966075</a> - Hewlett-Packard HP-UX line printer daemon buffer overflow</b> <br> <br> A buffer overflow exists in HP-UX's line printer daemon (rlpdaemon) that may allow an intruder to execute arbitrary code with superuser privilege on the target system. The rlpdaemon is installed by default and is active even if it is not being used. An intruder does not need any prior knowledge, or privileges on the target system, in order to exploit this vulnerability. </P> <A NAME="impact"> <H2>II. Impact</H2> <p> All of these vulnerabilities can be exploited remotely. In most cases, they allow an intruder to execute arbitrary code with the privileges of the lpd server. In some cases, an intruder must have access to a machine listed in /etc/hosts.equiv or /etc/hosts.lpd, and in some cases, an intruder must be able to control a nameserver. <p>One vulnerability (<a href="http://www.kb.cert.org/vuls/id/39001">VU#39001</a>) allows you to specify options to sendmail that can be used to execute arbitrary commands. Ordinarily, this vulnerability is only exploitable from machines that are authorized to use the lpd server. However, in conjunction with another vulnerability (<a href="http://www.kb.cert.org/vuls/id/30308">VU#30308</a>), permitting intruders to gain access to the lpd service, this vulnerability can be used by intruders not normally authorized to use the lpd service. <p>For specific information about the impacts of each of these vulnerabilities, please consult the CERT Vulnerability Notes Database (<a href="http://www.kb.cert.org/vuls">http://www.kb.cert.org/vuls</a>). </p> <A NAME="solution"> <H2>III. Solution</H2> <H4>Apply a patch from your vendor</H4> <P><A HREF="#vendors">Appendix A</A> contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Please contact your vendor directly.</P> <p>This table represents the status of each vendor with regard to each vulnerability. Please be aware that vendors produce multiple products; if they are listed in this table, not all products may be affected. If a vendor is not listed in the table below, then their status should be considered unknown. For specific information about the status of each of these vulnerabilities, please consult the CERT Vulnerability Notes Database (<a href="http://www.kb.cert.org/vuls">http://www.kb.cert.org/vuls</a>). </p> <table width=90% border=2 align=center> <tr> <td></td> <td><b><a href="http://www.kb.cert.org/vuls/id/274043">VU#274043</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/388183">VU#388183</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/722143">VU#722143</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/466239">VU#466239</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/39001">VU#39001</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/30308">VU#30308</a></b></td> <td><b><a href="http://www.kb.cert.org/vuls/id/966075">VU#966075</a></b></td> </tr> <tr> <td><center><b>Vendors Affected</b></center> </td> <td name="VU#274043"> Berkeley Software Design, Inc. (BSDI)<br> FreeBSD<br> NetBSD<br> OpenBSD<br> Red Hat<br> SCO<br> SGI<br> SuSE<br> </td> <td name="VU#388183"> IBM<br> </td> <td name="VU#722143"> IBM<br> </td> <td name="VU#466239"> IBM<br> </td> <td name="VU#39001"> Debian<br> Mandrake<br> Red Hat<br> Sun<br> </td> <td name="VU#30308"> Debian<br> IBM<br> Red Hat<br> </td> <td name="VU#966075"> Hewlett-Packard<br> </td> </tr> <tr> <td><center><b>Vendors Not Affected</b></center> </td> <td name="VU#274043"> Caldera<br> Engarde<br> Fujitsu<br> IBM<br> Sun<br> </td> <td name="VU#388183"> Apple<br> Caldera<br> Cray<br> Engarde<br> FreeBSD<br> Fujitsu<br> Red Hat<br> Sun<br> </td> <td name="VU#722143"> Apple<br> Caldera<br> Cray<br> Engarde<br> FreeBSD<br> Fujitsu<br> Red Hat<br> Sun<br> </td> <td name="VU#466239"> Apple<br> Caldera<br> Cray<br> Engarde<br> FreeBSD<br> Fujitsu<br> Red Hat<br> Sun<br> </td> <td name="VU#39001"> Caldera<br> Cray<br> Engarde<br> FreeBSD<br> Fujitsu<br> IBM<br> </td> <td name="VU#30308"> Apple<br> Caldera<br> Engarde<br> FreeBSD<br> Fujitsu<br> Sun<br> </td> <td name="VU#966075"> Apple<br> Caldera<br> Cray<br> Engarde<br> FreeBSD<br> Fujitsu<br> IBM<br> Red Hat<br> Sun<br> </td> </tr> </table> <br> <H4>Restrict access to the lpd service</H4> <p>As a general practice, we recommend disabling all services that are not explicitly required. You may wish to disable the line printer daemon if there is not a patch available from your vendor.</P> <p>If you cannot disable the service, you can limit your exposure to these vulnerabilities by using a router or firewall to restrict access to port 515/TCP (printer). Note that this does not protect you against attackers from within your network. <A NAME="vendors"> <H2>Appendix A. - Vendor Information</H2> <P>This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.</P> <!-- end vendor --> <A NAME="apple"> <H4>Apple Computer, Inc.</H4> Mac OS X does not have the line printer daemon vulnerability issues described in these advisories. <!-- end vendor --> <A NAME="bsdi"> <H4>Berkeley Software Design, Inc. (BSDI)</H4> Some (older) versions are affected. The current (BSD/OS 4.2) release is not vulnerable. Systems are only vulnerable to attack from hosts which are allowed via the /etc/hosts.lpd file (which is empty as shipped). <br><br> BSD/OS 4.1 is the only vulnerable version which is still officially supported by Wind River Systems. A patch (M410-044) is available in the normal locations, <a href="ftp://ftp.bsdi.com/bsdi/patches">ftp://ftp.bsdi.com/bsdi/patches</a> or via our web site at <a href="http://www.bsdi.com/support">http://www.bsdi.com/support</a> <!-- end vendor --> <A NAME="Compaq"> <H4>Compaq</H4> Compaq has not been able to reproduce the problems identified in this advisory for TRU64 UNIX. We will continue testing and address the LPD issues if a problem is discovered and provide patches as necessary. <!-- end vendor --> <A NAME="cray"> <H4>Cray</H4> Cray, Inc. has been unable to prove an lpd vulnerability. However, it was deemed that a buffer overflow may be possible and so did tighten up the code. See Cray SPR 721101 for more details. <!-- end vendor --> <A NAME="debian"> <H4>Debian</H4> <a href="http://www.debian.org/security/2000/20000109">http://www.debian.org/security/2000/20000109</a> <!-- end vendor --> <A NAME="freebsd"> <H4>FreeBSD, Inc.</H4> <a href="ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01%3A58.lpd.asc">ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01%3A58.lpd.asc</a> <!-- end vendor --> <A NAME="hp"> <H4>Hewlett-Packard Company</H4> Hewlett-Packard has released <br><br> HPSBUX0108-163 Sec. Vulnerability in rlpdaemon <br> <br> Bulletin and patches available from <a href="http://itrc.hp.com">http://itrc.hp.com</a> <br> <br> Details to access http://itrc.hp.com are included at the last half of any HP Bulletin. <!-- end vendor --> <A NAME="ibm"> <H4>IBM Corporation</H4> <a href="http://www-1.ibm.com/services/continuity/recover1.nsf/4699c03b46f2d4f68525678c006d45ae/85256a3400529a8685256ac7005cf00a/$FILE/oar391.txt">http://www-1.ibm.com/services/continuity/recover1.nsf/4699c03b46f2d4f68525678c006d45ae/</a><br> <a href="http://www-1.ibm.com/services/continuity/recover1.nsf/4699c03b46f2d4f68525678c006d45ae/85256a3400529a8685256ac7005cf00a/$FILE/oar391.txt">85256a3400529a8685256ac7005cf00a/$FILE/oar391.txt</A> <!-- end vendor --> <A NAME="mandrake"> <H4>Mandrake Software</H4> <a href="http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-054.php3">http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-054.php3</a> <!-- end vendor --> <A NAME="netbsd"> <H4>NetBSD</H4> If lpd has been enabled, this issue affects NetBSD versions 1.5.2 and prior releases, and NetBSD-current prior to August 30, 2001. lpd is disabled by default in NetBSD installations. <br> <br> Detailed information will be released subsequent to the publication of this CERT advisory. <br> <br> An up-to-date PGP signed copy of the release will be maintained at <br> <br> <a href="ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-018.txt.asc">ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-018.txt.asc</a> <br> <br> Information about NetBSD and NetBSD security can be found at <a href="http://www.NetBSD.ORG/">http://www.NetBSD.ORG</a> and <a href="http://www.NetBSD.ORG/Security/">http://www.NetBSD.ORG/Security/</a>. <!-- end vendor --> <A NAME="openbsd"> <H4>OpenBSD</H4> <a href="http://www.openbsd.org/errata29.html#lpd">http://www.openbsd.org/errata29.html#lpd</a> <!-- end vendor --> <A NAME="redhat"> <H4>RedHat Inc.</H4> <a href="http://www.redhat.com/support/errata/RHSA2000002-01.6.0.html">http://www.redhat.com/support/errata/RHSA2000002-01.6.0.html</a> <br> <a href="http://www.redhat.com/support/errata/RHSA-2001-147.html">http://www.redhat.com/support/errata/RHSA-2001-147.html</a> <!-- end vendor --> <A NAME="sco"> <H4>Santa Cruz Operation, Inc. (SCO)</H4> <a href="ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.20/">ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.20/</a> <!-- end vendor --> <A NAME="sgi"> <H4>SGI</H4> <a href="ftp://patches.sgi.com/support/free/security/advisories/20011003-01-P">ftp://patches.sgi.com/support/free/security/advisories/20011003-01-P</A> <!-- end vendor --> <A NAME="suse"> <H4>SuSE</H4> <a href="http://lists2.suse.com/archive/suse-security-announce/2001-Oct/0000.html">http://lists2.suse.com/archive/suse-security-announce/2001-Oct/0000.html</a> <!-- end vendor --> <HR NOSHADE> <P>The CERT Coordination Center thanks Internet Security Systems (<a href="http://xforce.iss.net/alerts/advise93.php">1</a>)(<a href="http://xforce.iss.net/alerts/advise94.php">2</a>) and <a href="http://www-1.ibm.com/services/continuity/recover1.nsf/4699c03b46f2d4f68525678c006d45ae/85256a3400529a8685256ac7005cf00a/$FILE/oar391.txt">IBM</A> for the information provided in their advisories.</P> <P></P> <HR NOSHADE> <P>Feedback on this document can be directed to the author, <A HREF="mailto:cert@cert.org?subject=CA-2001-30%20Feedback%20VU%23274043">Jason A. Rafail</A> <p></p> <HR NOSHADE> <p>References</p> <ul> <li> <a href="http://www.kb.cert.org/vuls/id/274043">http://www.kb.cert.org/vuls/id/274043</a> <li> <a href="http://www.kb.cert.org/vuls/id/388183">http://www.kb.cert.org/vuls/id/388183</a> <li> <a href="http://www.kb.cert.org/vuls/id/722143">http://www.kb.cert.org/vuls/id/722143</a> <li> <a href="http://www.kb.cert.org/vuls/id/466239">http://www.kb.cert.org/vuls/id/466239</a> <li> <a href="http://www.kb.cert.org/vuls/id/39001">http://www.kb.cert.org/vuls/id/39001</a> <li> <a href="http://www.kb.cert.org/vuls/id/30308">http://www.kb.cert.org/vuls/id/30308</a> <li> <a href="http://www.kb.cert.org/vuls/id/966075">http://www.kb.cert.org/vuls/id/966075</a> <li> <a href="http://www.kb.cert.org/vuls">http://www.kb.cert.org/vuls</a> </ul> <P></P> <!--#include virtual="/include/footer_nocopyright.html" --> <P>Copyright 2001 Carnegie Mellon University.</P> <P>Revision History <PRE> November 05, 2001: Initial release November 07, 2001: Updated FreeBSD Systems Affected November 08, 2001: Updated Red Hat Statement November 09, 2001: Updated Apple Table Status November 15, 2001: Modified Credit Statement </PRE> |