Vulnerability Note VU#466239

IBM AIX line printer daemon contains a buffer overflow in chk_fhost()

Original Release date: 16 Oct 2001 | Last revised: 03 Jan 2002

Overview

The Line Printer daemon (lpd) shipped with AIX systems contains a buffer overflow in chk_fhost() that potentially allow a malicious remote user to gain root privileges.

Description

A buffer overflow exists in the chk_fhost() function of the line printer daemon (lpd) on AIX systems. An intruder could exploit this vulnerability to obtain root privileges or cause a denial of service (DoS). The intruder would need control of the DNS server to exploit this vulnerability.

Impact

An intruder could exploit this vulnerability to obtain root privileges, or cause a denial of service (DoS).

Solution

IBM has released a VULNERABILITY SUMMARY. Please see the vendor statement for patches and instructions.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
IBMAffected-04 Oct 2001
AppleNot Affected-09 Nov 2001
CalderaNot Affected04 Sep 200101 Nov 2001
CrayNot Affected-01 Nov 2001
EngardeNot Affected-01 Nov 2001
FreeBSDNot Affected-05 Nov 2001
FujitsuNot Affected-01 Nov 2001
Red HatNot Affected-08 Nov 2001
SunNot Affected-01 Nov 2001
Compaq Computer CorporationUnknown-05 Nov 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC wishes to thank IBM for their help in identifying and analyzing this vulnerability.

This document was written by Jason Rafail.

Other Information

  • CVE IDs: CAN-2001-0671
  • Date Public: 11 Sep 2001
  • Date First Published: 16 Oct 2001
  • Date Last Updated: 03 Jan 2002
  • Severity Metric: 9.84
  • Document Revision: 8

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.