Vulnerability Note VU#39001

lpd allows options to be passed to sendmail

Original Release date: 16 Oct 2001 | Last revised: 09 Nov 2001

Overview

The line printer daemon enables various clients to share printers over a network. There exists a vulnerability in this daemon that permits an intruder to send options to sendmail.

Description

The line printer daemon enables various clients to share printers over a network. There exists a vulnerability in this daemon that permits an intruder to send options to sendmail. These options could be used to specify another configuration file allowing an intruder to gain root access.

Impact

An intruder may be able to gain root access. In conjunction with another vulnerability (e.g., VU#30308), this can be exploited from hosts not normally authorized to use the lpd service.

Solution

Apply the patches, if available, from your vendor.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
DebianAffected-04 Oct 2001
MandrakeSoftAffected04 Oct 200130 Oct 2001
Red Hat Inc.Affected-04 Oct 2001
Sun Microsystems Inc.Affected-31 Jul 2002
CalderaNot Affected04 Sep 200130 Oct 2001
Cray Inc.Not Affected-30 Oct 2001
EngardeNot Affected-30 Oct 2001
FreeBSDNot Affected-05 Nov 2001
FujitsuNot Affected-31 Oct 2001
IBMNot Affected-30 Oct 2001
Apple Computer Inc.Unknown-09 Nov 2001
Compaq Computer CorporationUnknown-05 Nov 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC would like to thank @Stake, Red Hat and Debian for the information provided in their security advisories.

This document was written by Jason Rafail.

Other Information

  • CVE IDs: Unknown
  • Date Public: 08 Jan 2000
  • Date First Published: 16 Oct 2001
  • Date Last Updated: 09 Nov 2001
  • Severity Metric: 14.06
  • Document Revision: 13

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.