{"vuid":"VU#484011","idnumber":"484011","name":"Solaris Line Printer Daemon (in.lpd) vulnerable to buffer overflow via transfer job routine","keywords":["Solaris Line Printer Daemon","in.lpd","print protocol daemon","buffer overflow","transfer job routine","port 515"],"overview":"A buffer overflow exists in the Solaris line printer daemon (in.lpd) that may allow a remote  intruder to execute arbitrary code with the privileges of the running in.lpd. This daemon runs with root privileges by default on all recent versions of Solaris.","clean_desc":"The Solaris in.lpd provides services for remote users to interact with a local printer, listening for remote requests on port 515/tcp. There is an unchecked buffer in the part of the code responsible for transferring print jobs from one machine to another. If given too many jobs to work on at once, an attacker can either crash the printer daemon or attempt to execute arbitrary code with super user privileges on the victim system. This problem was discovered by ISS X-Force and posted here on June 19, 2001. Vulnerable versions of Solaris are as follows: Solaris 2.6\nSolaris 2.6 x86\nSolaris 7\nSolaris 7 x86\nSolaris 8\nSolaris 8 x86 Sun recommends the following workarounds until the patches identified below may be applied: Disable the print service in /etc/inetd.conf\nEnable the noexec_user_stack tunable \nBlock access to 515/tcp (printer) at all appropriate network perimeters","impact":"A remote intruder may be able to execute arbitrary code with the privileges in the running daemon (typically root). In addition, a remote intruder may be able to crash vulnerable printer daemons.","resolution":"Patches have been released by Sun. They are part of a jumbo lp patch set identified by the following ids, per Sun Security Bulletin #206: The following patches are available in relation to the above problem. OS Version               Patch ID SunOS 5.8                109320-04\n    SunOS 5.8_x86            109321-04\n    SunOS 5.7                107115-09\n    SunOS 5.7_x86            107116-09\n    SunOS 5.6                106235-09\n    SunOS 5.6_x86            106236-09 The in.lpd daemon was not available prior to Solaris 2.6. These patches resolve Sun problem report 4446925 *in.lpd* contains a remote exploitable overflow.","workarounds":"<H4> Workarounds</H4> Disable the print service in /etc/inetd.conf\nEnable the noexec_user_stack tunable \nBlock access to 515/tcp (printer) at all appropriate network perimeters","sysaffected":"","thanks":"The X-Force team of Internet Security Systems, Inc. has released an \nadvisory \nabout this issue.","author":"This document was written by Jeffrey S. Havrilla","public":["(X-Force Advisory 80, http://xforce.iss.net/alerts/advise80.php)","http://www.securityfocus.com/bid/2894","http://www.sun.com/security","http://sunsolve.Sun.COM/pub-cgi/secBulletin.pl"],"cveids":["CVE-2001-0353"],"certadvisory":"CA-2001-15","uscerttechnicalalert":null,"datecreated":"2001-06-20T16:05:09Z","publicdate":"2001-06-19T00:00:00Z","datefirstpublished":"2001-06-21T21:04:27Z","dateupdated":"2001-08-31T17:30:08Z","revision":12,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"18","cam_exploitation":"0","cam_internetinfrastructure":"15","cam_population":"16","cam_impact":"20","cam_easeofexploitation":"15","cam_attackeraccessrequired":"19","cam_scorecurrent":"56.43","cam_scorecurrentwidelyknown":"59.85","cam_scorecurrentwidelyknownexploited":"94.05","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":56.43,"vulnote":null}