Bugtraq mailing list archives
FreeBSD-SA-97:02: Buffer overflow in lpd
From: aleph1 () DFW NET (Aleph One)
Date: Wed, 26 Mar 1997 16:59:12 -0600
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-97:02 Security Advisory FreeBSD, Inc. Topic: Buffer overflow in lpd Category: core Module: lpd Announced: 1997-03-xxx Affects: FreeBSD 2.1.7 and earlier and FreeBSD 2.2 snapshots before 1997/02/25 suffer from this problem. Corrected: FreeBSD-current as of 1997/02/25 FreeBSD 2.2 as of 1997/02/25 FreeBSD only: yes Patches: ftp://freebsd.org/pub/CERT/patches/SA-97:02/ ============================================================================= I. Background The lpd program is used to print local and remote print jobs. It is standard software in the FreeBSD operating system. II. Problem Description The lpd program runs as root. A remote attacker can exploit a buffer overflow to obtain root privs. III. Impact Remote users can gain root privs. IV. Workaround The only workaround is to disable lpd, which will have the effect of removing the printing functionality from the system. Since the buffer overflow happens before the connection is authenticated, using lpd's authentication methods will not affect the system vulnerability. V. Solution Apply the following patch, rebuild and install libc: (This patch can also be found on ftp://freebsd.org/pub/CERT/patches/SA-97:02/) Index: rcmd.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/net/rcmd.c,v retrieving revision 1.3.4.4 retrieving revision 1.3.4.5 diff -u -r1.3.4.4 -r1.3.4.5 --- rcmd.c 1997/02/09 06:57:54 1.3.4.4 +++ rcmd.c 1997/02/26 06:14:11 1.3.4.5 @@ -377,7 +377,8 @@ if ((hp = gethostbyaddr((char *)&raddr, sizeof(u_long), AF_INET)) == NULL) return (-1); - strcpy(hname, hp->h_name); + strncpy(hname, hp->h_name, sizeof(hname)); + hname[sizeof(hname) - 1] = '\0'; while (fgets(buf, sizeof(buf), hostf)) { p = buf; VI. Thanks This problem was brought to light by Oliver Friedrichs <oliver () SECNET COM>. ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer () freebsd org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications () freebsd org Security public discussion: security () freebsd org Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMzmOqlUuHi5z0oilAQH1hAP/fSVklicjFNo4hLVO2dYLLiIPnB9uVWNl ocC2Ozu1sX6SH3Kz688QlTEnyDzjshkisI9nr+947A/CjwJDPwqQRbqmbAdI+qka HNQJmVQYWW2J6j70SJX8q0z1uQHoNsJB7VStQ1VX+4BD91CsjBr3lrU5xFyjqxYt uJMeNl0sa9A= =agxY -----END PGP SIGNATURE-----
Current thread:
- Latest IE FIX from MS is a HOAX, (continued)
- Latest IE FIX from MS is a HOAX Aaron Spangler (Mar 25)
- Re: Latest IE FIX from MS is a HOAX Michael H. Warfield (Mar 25)
- ANNOUNCE : NTCrack v1.0 Jonathan Wilkins (Mar 27)
- There are more loopholes in LPD Patrick Powell (Mar 28)
- symlink bug in tin/rtin NetRunner (Mar 29)
- Re: symlink bug in tin/rtin Nelson Murilo (Mar 29)
- ANNOUNCE : NTCrack v2.0 Jonathan Wilkins (Mar 29)
- more sendmail poop *Hobbit* (Mar 25)
- Reported Sendmail 8.8.4 Exploit gshapiro () SENDMAIL ORG (Mar 25)
- minor vulnerability in ELM Dmitry E. Kim (Mar 26)
- FreeBSD-SA-97:02: Buffer overflow in lpd Aleph One (Mar 26)
- Cisco 2509/2511 Albert Siersema (Mar 24)
- Re: Cisco 2509/2511 Dan Brown (Mar 24)
- Re: Cisco 2509/2511 Erdinc KAYA (Mar 24)
- Re: your mail Illuminati Primus (Mar 24)
- ObNag: running sendmail as root Tom Guptill (Mar 24)