Vulnerability Note VU#30308

Overview

The line printer daemon enables various clients to share printers over a network. There exists a flaw in the authentication method in this daemon that permits remote access to the server.

Description

A vulnerability exists in the line printer daemon (lpd) shipped with the lpr package for several systems. The authentication method was not thorough enough. If a remote user was able to control their own DNS so that their IP address resolved to the hostname of the print server, access would be granted when it should not be.

Impact

An Intruder can gain unauthorized access to the lpd server. In conjunction with another vulnerability (e.g. VU#39001), an intruder may be able to gain additional privileges.

Solution

Apply the patches provided by your vendor.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple	Not Vulnerable	-	20 Apr 2002
Caldera	Not Vulnerable	04 Sep 2001	20 Apr 2002
Compaq Computer Corporation	Unknown	-	20 Apr 2002
Debian	Vulnerable	-	20 Apr 2002
FreeBSD	Not Vulnerable	-	20 Apr 2002
Fujitsu	Not Vulnerable	-	20 Apr 2002
IBM	Vulnerable	-	20 Apr 2002
RedHat	Vulnerable	-	20 Apr 2002
Sun	Not Vulnerable	-	20 Apr 2002

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.kb.cert.org/vuls/id/39001
• http://www.atstake.com/research/advisories/2000/lpd_advisory.txt
• http://www.redhat.com/support/errata/RHSA2000002-01.6.0.html
• http://www.debian.org/security/2000/20000109

Credit

The CERT/CC would like to thank Red Hat and Debian for the information provided in their security advisories.

This document was written by Jason Rafail.

Other Information

• CVE IDs: Unknown
• Date Public: 08 Jan 2000
• Date First Published: 16 Oct 2001
• Date Last Updated: 09 Nov 2001
• Severity Metric: 7.87
• Document Revision: 10

Was this document helpful?   Yes   |   Somewhat   |  No