SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#966075

HP-UX vulnerable to buffer overflow in line printer daemon (rlpdaemon) via crafted print request

Overview

The line printer daemon (rlpdaemon) on HP-UX systems enable various clients to share printers over a network. There exists a buffer overflow vulnerability in this daemon that permits remote execution of arbitrary commands with elevated privileges.

I. Description

A buffer overflow exists in HP-UX's line printer daemon (rlpdaemon) that may allow an intruder to execute arbitrary code with superuser privilege on the target system. The rlpdaemon is installed by default and is active even if it is not being used. An intruder does not need any prior knowledge, or privileges on the target system in order to exploit this vulnerability.

II. Impact

An intruder can execute arbitrary commands.

III. Solution

Hewlett-Packard has released HPSBUX0108-163 to address this issue. Please see the vendor statement for instructions and patches.

Systems Affected
VendorStatusDate NotifiedDate Updated
AppleNot Vulnerable1-Nov-2001
CalderaNot Vulnerable31-Oct-2001
Compaq Computer CorporationUnknown5-Nov-2001
CrayNot Vulnerable1-Nov-2001
EngardeNot Vulnerable1-Nov-2001
FreeBSDNot Vulnerable5-Nov-2001
FujitsuNot Vulnerable31-Oct-2001
Hewlett PackardVulnerable4-Oct-2001
IBMNot Vulnerable31-Oct-2001
Red HatNot Vulnerable8-Nov-2001
SunNot Vulnerable1-Nov-2001

References


http://www.securityfocus.com/bid/3240
http://xforce.iss.net/alerts/advise93.php
http://itrc.hp.com
http://www.ciac.org/ciac/bulletins/l-134.shtml

Credit

This vulnerability was discovered and researched by Chris Spencer of Internet Security Systems (ISS). The CERT/CC wishes to thank ISS for the information contained in their advisory.

This document was written by Jason Rafail.

Other Information

Date Public:2001-08-27
Date First Published:2001-10-16
Date Last Updated:2001-11-09
CERT Advisory: 
CVE-ID(s):CAN-2001-0668
NVD-ID(s):CAN-2001-0668
US-CERT Technical Alerts: 
Metric:18.75
Document Revision:9

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2001 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader