LPRng Vulnerability
Updated 8/29/01
CVE 2000-0917
Impact
If vulnerabilities are present in LPRng, a remote attacker could
execute arbitrary code on the server. Also, Internet worms
have been known to exploit vulnerabilities in LPRng to further
their propogation.
Background
The print process is controlled by a process called lpd.
The lpd process is a UNIX daemon that accepts print
requests from local and remote users. LPRng
is a popular version of lpd which provides
enhancements and comes enabled by default with several
open-source operating systems.
LPRng can include a number of optional files called print
filters which provide the print service with instructions
on processing specific
document types. One such filter is available to process
Device Independent (DVI) files.
The DVI print filter uses the dvips utility
(part of the teTeX package)
to convert DVI documents to PostScript.
The Problem
There are two problems in LPRng which could allow a remote
attacker to gain unauthorized access to the system. The first
problem is caused by missing format strings in calls to the
syslog function. This bug could allow a
remote attacker to cause a segmentation fault and crash the
print service. Furthermore,
arbitrary code injected into the print service's memory
space by other means could be executed.
Versions of LPRng prior to 3.6.25 are affected by this
vulnerability.
8/29/01
The second problem is not a vulnerability in LPRng itself,
but instead is caused by insecure configuration of the
DVI print filter. If the print filter calls the dvips
program without the appropriate security option, it could
be possible for a remote attacker to execute arbitrary commands
by embedding the commands into a DVI document which is
sent to the print service. This vulnerability can only be
exploited if all of the following conditions exist:
- The DVI print filter is present. (It is usually called dvi-to-ps.fpi.)
- The dvips utility is present.
- The DVI print filter calls the dvips utility
without the -R option. (The -R
option prevents execution of embedded commands.)
Red Hat 7.0 and possibly other operating systems are affected
by this vulnerability in their default configuration.
Resolution
If print service is not needed, disable lpd.
Otherwise, the format string vulnerability can be fixed by
upgrading to the latest
version of LPRng. The insecure configuration in the DVI
print filter can be fixed by changing the line:
dvips -f $DVIPS_OPTIONS < $TMP_FILE
to
dvips -R -f $DVIPS_OPTIONS < $TMP_FILE
in the file dvi-to-ps.fpi. This file is
located in the /usr/lib/rhs/rhs-printfilters
directory on Red Hat Linux systems but may be located elsewhere on
other systems.
Where can I read more about this?
More information on the format string vulnerability is available from
CERT
Advisory 2000-22. The configuration problem in the DVI
print filter was posted to
Bugtraq.