IRIX lpd vulnerability

Updated 4/16/03
CVE 2001-0670

Impact

A remote user could execute arbitrary code on a properly configured print server.

Background

IRIX operating systems include a Line Printer Daemon (lpd) which provides printer service to local and remote users. The printer service transfers print requests to printers, manages printer queues, and provides job control functions to users.

The Problem

Buffer overflow in displayq()

CVE 2001-0670
Due to a buffer overflow in the part of the code which processes print requests, a remote attacker could execute arbitrary code on the server with root privileges by sending a specially crafted, incomplete print job to the printer service, and then requesting a display of the printer queue. IRIX 6.5 through 6.5.13 are affected by this vulnerability.

In order for this vulnerability to be exploited, the following conditions must exist:

  1. The printer service must be configured.
  2. The printer service must be running.
  3. The attacker's host must be granted permission to use the printer service. The /etc/hosts.equiv and /etc/hosts.lpd files contain a list of hosts which are allowed to use the service.

Transmission of Sendmail options

11/22/02
4/16/03
A vulnerability in lpd could allow a remote attacker to send options to Sendmail. By sending an option which specifies another configuration file, the attacker could gain root access to the server. IRIX 6.5 through 6.5.19 are affected by this vulnerability.

Hostname Authentication Bypass

11/22/02
4/16/03
Due to a flaw in the line printer daemon's hostname authentication function, a remote attacker who would otherwise be denied access to the print server could gain access by falsifying the DNS record of the attacking host such that it resolves to the same host name as the print server. This vulnerability could be used in conjunction with other vulnerabilities to gain root access from a host which is not listed in /etc/hosts.equiv or /etc/hosts.lpd. Exploitation of this vulnerability would require the attacker to have control of his or her own DNS server.

IRIX 6.5 through 6.5.19 are affected by this vulnerability.

Resolution

If print service is not needed, disable lpd. This is done by issuing the following command when logged on as root:
kill -9 <pid>
where <pid> is the process ID. Also, modify the boot-up scripts so that the print service does not start again when the machine is rebooted.

If print service is required, then a patch should be applied as soon as possible. Check SGI Security Advisory 20030406-01-P for patch information. It would also be advisable to allow access only to trusted hosts. This can be done by modifying the /etc/hosts.equiv and /etc/hosts.lpd files such that they only contain a list of trusted hosts.

Where can I read more about this?

This vulnerability was reported in CERT Advisory 2001-30 and SGI Security Advisories 20021104-01-P and 20030406-01-P.