Vulnerability Note VU#388183

Overview

The Line Printer daemon (lpd) shipped with AIX systems contains a buffer overflow in kill_print() that potentially allow a malicious remote user to gain root privileges.

Description

A buffer overflow exists in the kill_print() function of the line printer daemon (lpd) on AIX systems. An intruder could exploit this vulnerability to obtain root privileges or cause a denial of service (DoS). The intruder would need to be listed in the victim's /etc/hosts.lpd or /etc/hosts.equiv file, however, to exploit this vulnerability.

Impact

An intruder could exploit this vulnerability to obtain root privileges, or cause a denial of service (DoS).

Solution

IBM has released a VULNERABILITY SUMMARY. Please see the vendor statement for patches and instructions.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
IBM	Affected	-	16 Oct 2001
Apple	Not Affected	-	09 Nov 2001
Caldera	Not Affected	04 Sep 2001	01 Nov 2001
Cray	Not Affected	-	01 Nov 2001
Engarde	Not Affected	-	01 Nov 2001
FreeBSD	Not Affected	-	05 Nov 2001
Fujitsu	Not Affected	-	01 Nov 2001
Red Hat	Not Affected	-	08 Nov 2001
Sun	Not Affected	-	01 Nov 2001
Compaq Computer Corporation	Unknown	-	05 Nov 2001

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.uniras.gov.uk/l1/l2/l3/brief2001/UNIRAS%20Briefing%20-%2016301%20-%20IBM%20%20-%20Buffer%20Overflow%20Vulnerabilities%20in%20lpd.txt
• http://archives.neohapsis.com/archives/bugtraq/2001-09/0084.html

Credit

The CERT/CC wishes to thank IBM for their help in identifying and analyzing this vulnerability.

This document was written by Jason Rafail.

Other Information

• CVE IDs: CAN-2001-0671
• Date Public: 11 Sep 2001
• Date First Published: 16 Oct 2001
• Date Last Updated: 03 Jan 2002
• Severity Metric: 9.84
• Document Revision: 12