-----BEGIN PGP SIGNED MESSAGE----- [ For Public Release ] __________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Unix lpr Buffer Overrun Vulnerability (Update to vendor patches H-08) June 25, 1997 16:00 GMT Number H-74 ______________________________________________________________________________ PROBLEM: A vulnerability exists in the BSD-based lpr printing package found on many Unix systems. PLATFORM: A variety of Unix platforms. DAMAGE: This vulnerability may allow local users to gain root privileges. SOLUTION: Until vendor patches are available it is recommend that you apply the wrapper described below. ______________________________________________________________________________ VULNERABILITY Exploit information and patches involving this vulnerability ASSESSMENT: have been publicly available for some time. Recently, the CERT/CC has received reports that the vulnerability is being actively exploited. ______________________________________________________________________________ [ Start CERT Advisory ] ============================================================================= CERT* Advisory CA-97.19 Original issue date: June 25, 1997 Last revised: -- Topic: lpr Buffer Overrun Vulnerability - ------------------------------------------------------------------------------ The technical content of this advisory was originally published by AUSCERT (AA-96.12), who last updated the information on June 19, 1997. We use it here with their permission. - ---------------------------------------------------------------------------- There is a vulnerability in the BSD-based printing software, lpr, available on a variety of Unix platforms. This vulnerability may allow local users to gain root privileges. Exploit information involving this vulnerability has been publicly available for some time. Recently, the CERT/CC has received reports that the vulnerability is being actively exploited. We recommend installing a vendor patch if one is available. Until you can do so, we recommend using the wrapper described in Section III.B. We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site. - ----------------------------------------------------------------------------- I. Description A vulnerability exists in the BSD-based lpr printing package found on many Unix systems. Due to insufficient bounds checking on arguments that are supplied by users, it is possible to overwrite the internal stack space of the lpr program while it is executing. This can allow an intruder to cause lpr to execute arbitrary commands by supplying a carefully designed argument to lpr. These commands will be run with the privileges of the lpr program. When lpr is installed setuid or setgid, it may allow intruders to gain those privileges. When lpr is setuid root, it may allow intruders to run arbitrary commands with root privileges. For information from vendors relating to this vulnerability, please check Appendix A of this advisory. In addition to the products mentioned, be aware that platforms using the BSD-based lpr systems, in which lpr is installed setuid or setgid, may also be vulnerable. Note also that the vulnerability described in this advisory is not present in the LPRng printing package. II. Impact Local users may gain root privileges. It is necessary to have access to an account on the system to exploit this vulnerability. III. Solution The lpr printing package is available on many different systems. As vendor patches are made available sites are encouraged to install them. Until vendor patches are available, we recommend applying the workaround referred to in III.B. A. Install vendor patches Specific vendor information has been placed in Appendix A. If the BSD- based lpr printing software is used and your vendor is not listed in Appendix A, please contact your vendor directly. B. Install lpr wrapper Until you can install a vendor patch, we encourage you install a wrapper developed by AUSCERT to help prevent lpr being exploited using this vulnerability. The source for the wrapper, including installation instructions, can be found at ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c This wrapper replaces the lpr program and checks the length of the command line arguments which are passed to it. If an argument exceeds a certain predefined value (MAXARGLEN), the wrapper exits without executing the lpr command. The wrapper program can also be configured to syslog any failed attempts to execute lpr with arguments exceeding MAXARGLEN. For further instructions on using this wrapper, please read the comments at the top of overflow_wrapper.c. When compiling overflow_wrapper.c for use with lpr, AUSCERT recommends defining MAXARGLEN to be 32. The MD5 checksum for the current version of overflow_wrapper.c can be retrieved from ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM The CHECKSUM file has been digitally signed using the AUSCERT PGP key. - ------------------------------------------------------------------------------ Appendix A Vendor information Below is a list of the vendors who have provided information. We will update this appendix as we receive additional information. If you do not see your vendor's name, please contact the vendor directly. Berkeley Software Design, Inc. (BSDI) ====================================== BSD/OS 3.0 is not vulnerable to the problem. BSDI have issued a patch which addresses this vulnerability under BSD/OS 2.1. This patch is available from: ftp://ftp.bsdi.com/pub/bsdi/patches/patches-2.1/U210-028 Digital Equipment Corporation ============================= Digital Equipment Corporation Software Security Response Team Copyright (c) Digital Equipment Corporation 1997. All rights reserved. This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software. - DIGITAL EQUIPMENT CORPORATION 06/19/97 FreeBSD ======= This problem was fixed prior to the release of FreeBSD 2.1.6 and 2.2. Users running older versions of the OS should review the security advisory describing this vulnerability (SA-96.18) at: ftp://freebsd.org/pub/CERT/advisories/FreeBSD-SA-96:18.lpr.asc Patches can be found in the directory: ftp://freebsd.org/pub/CERT/patches/SA-96:18 IBM Corporation =============== AIX is not vulnerable to the lpr buffer overflow. The version of lpr shipped with AIX is not installed with the setuid bit turned on. IBM and AIX are registered trademarks of International Business Machines Corporation. Linux ===== The Linux Emergency Response Team have released a Linux Security FAQ Update which addresses this vulnerability. This Update contains information regarding various Linux distributions. It is available from: ftp://bach.cis.temple.edu/pub/Linux/Security/FAQ/updates/ Update-11-25-1996.vulnerability-lpr-0.06-v1.2 NeXT ==== The NeXT group has addressed the vulnerability described in this advisory in release 4.2 of OpenStep/Mach. The Santa Cruz Operation, Inc. (SCO) ==================================== SCO has determined that the following SCO operating systems are not vulnerable: - SCO CMW+ 3.0 - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4 - SCO OpenServer 5.0 - SCO UnixWare 2.1 Sun Microsystems, Inc. ===================== All versions of Solaris are not affected. SunOS 4.1.3_U1 and SunOS 4.1.4 are vulnerable. Sun recommends that sites using SunOS 4.1.3_U1 and SunOS 4.1.4 apply the workaround provided in this advisory. - ---------------------------------------------------------------------------- The CERT Coordination Center staff thanks AUSCERT for permission to republish the information in their advisory AA-96.12. AUSCERT originally thanked Alexander O. Yuriev, the FreeBSD security team, IBM, and the CERT/CC for their assistance in the production of their advisory. - ---------------------------------------------------------------------------- [ End CERT Advisory ] ______________________________________________________________________________ CIAC wishes to acknowledge the contributions of CERT & others for the information contained in this bulletin. ______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 510-422-8193 FAX: +1 510-423-8002 STU-III: +1 510-423-2604 E-mail: ciac@llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC duty person, and the secondary PIN number, 8550074 is for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://ciac.llnl.gov/ Anonymous FTP: ciac.llnl.gov (198.128.39.53) Modem access: +1 (510) 423-4753 (28.8K baud) +1 (510) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. CIAC-NOTES for Notes, a collection of computer security articles; 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 4. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called Majordomo, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting ciac-bulletin, ciac-notes, spi-announce OR spi-notes for list-name: E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov: subscribe list-name e.g., subscribe ciac-notes You will receive an acknowledgment email immediately with a confirmation that you will need to mail back to the addresses above, as per the instructions in the email. This is a partial protection to make sure you are really the one who asked to be signed up for the list in question. If you include the word 'help' in the body of an email to the above address, it will also send back an information file on how to subscribe/unsubscribe, get past issues of CIAC bulletins via email, etc. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) H-64: SGI IRIX login LOCKOUT parameter Vulnerability H-65: SGI IRIX rld Security Vulnerability H-66: Vulnerability in suidperl (sperl) H-67: Red Hat Linux X11 Libraries Buffer Overflow H-68: Windows95 Network Password Vulnerability H-69: Vulnerability in getopt (3) H-70: Vulnerability in rpcbind H-71: Vulnerability in the at(1) program H-72: SunOS eeprom Vulnerability H-73: SunOS chkey Vulnerability -----BEGIN PGP SIGNATURE----- Version: 4.0 Business Edition iQCVAwUBM7LNmLnzJzdsy3QZAQHkeQP/VTyXMqLexXEEJv43NQvEoRX+sC8cO3aS pSYh4SBIq3dF6IoNrfPnlVY12JYjlOSVna8RZOKdWyrvldg1NmHVu5uRvDzm+AQR yYD6q9aA+M+pw5a9moJ6dx6c6d+BMrfSp9irmvWin5fbQF7ieH2wVmAMtYiGfGEc +zPrNnZ7A3M= =PXiu -----END PGP SIGNATURE-----