**************************************************************************
Security Bulletin 9716 DISA Defense Communications System
June 25, 1997 Published by: DISN Security Coordination Center
(SCC@NIC.MIL)
1-(800) 365-3642
The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil.
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Information Systems Agency's Security !
! Coordination Center distribution system as a means of !
! providing DISN subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - +
- -----------------------------------------------------------------------------
- ---------------------------------------------------------------------------
There is a vulnerability in the BSD-based printing software, lpr, available on a variety of Unix platforms. This vulnerability may allow local users to gain root privileges.
Exploit information involving this vulnerability has been publicly available for some time. Recently, the CERT/CC has received reports that the vulnerability is being actively exploited.
We recommend installing a vendor patch if one is available. Until you can do so, we recommend using the wrapper described in Section III.B.
We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.
- ----------------------------------------------------------------------------
A vulnerability exists in the BSD-based lpr printing package found on many Unix systems.
Due to insufficient bounds checking on arguments that are supplied by users, it is possible to overwrite the internal stack space of the lpr program while it is executing. This can allow an intruder to cause lpr to execute arbitrary commands by supplying a carefully designed argument to lpr. These commands will be run with the privileges of the lpr program. When lpr is installed setuid or setgid, it may allow intruders to gain those privileges.
When lpr is setuid root, it may allow intruders to run arbitrary commands with root privileges.
For information from vendors relating to this vulnerability, please check Appendix A of this advisory. In addition to the products mentioned, be aware that platforms using the BSD-based lpr systems, in which lpr is installed setuid or setgid, may also be vulnerable.
Note also that the vulnerability described in this advisory is not present in the LPRng printing package.
Local users may gain root privileges. It is necessary to have access to an account on the system to exploit this vulnerability.
The lpr printing package is available on many different systems. As vendor patches are made available sites are encouraged to install them. Until vendor patches are available, we recommend applying the workaround referred to in III.B.
Specific vendor information has been placed in Appendix A. If the BSD-based lpr printing software is used and your vendor is not listed in Appendix A, please contact your vendor directly.
Until you can install a vendor patch, we encourage you install a wrapper developed by AUSCERT to help prevent lpr being exploited using this vulnerability.
The source for the wrapper, including installation instructions, can be
found at
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c
This wrapper replaces the lpr program and checks the length of the command line arguments which are passed to it. If an argument exceeds a certain predefined value (MAXARGLEN), the wrapper exits without executing the lpr command. The wrapper program can also be configured to syslog any failed attempts to execute lpr with arguments exceeding MAXARGLEN. For further instructions on using this wrapper, please read the comments at the top of overflow_wrapper.c.
When compiling overflow_wrapper.c for use with lpr, AUSCERT recommends defining MAXARGLEN to be 32.
The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM
The CHECKSUM file has been digitally signed using the AUSCERT PGP key.
...........................................................................
Below is a list of the vendors who have provided information. We will update this appendix as we receive additional information. If you do not see your vendor's name, please contact the vendor directly.
Berkeley Software Design, Inc. (BSDI)
======================================
BSD/OS 3.0 is not vulnerable to the problem.
BSD/OS 2.1. This patch is available from:
ftp://ftp.bsdi.com/pub/bsdi/patches/patches-2.1/U210-028
This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software.
This problem was fixed prior to the release of FreeBSD 2.1.6 and 2.2. Users running older versions of the OS should review the security advisory describing this vulnerability (SA-96.18) at:
ftp://freebsd.org/pub/CERT/advisories/FreeBSD-SA-96:18.lpr.asc
Patches can be found in the directory:
ftp://freebsd.org/pub/CERT/patches/SA-96:18
AIX is not vulnerable to the lpr buffer overflow. The version of lpr shipped with AIX is not installed with the setuid bit turned on.
IBM and AIX are registered trademarks of International Business Machines Corporation.
The Linux Emergency Response Team have released a Linux Security FAQ Update which addresses this vulnerability. This Update contains information regarding various Linux distributions.
It is available from:
ftp://bach.cis.temple.edu/pub/Linux/Security/FAQ/updates/
Update-11-25-1996.vulnerability-lpr-0.06-v1.2
The NeXT group has addressed the vulnerability described in this advisory in release 4.2 of OpenStep/Mach.
The Santa Cruz Operation, Inc. (SCO)
====================================
SCO has determined that the following SCO operating systems are not vulnerable:
Sun Microsystems, Inc.
=====================
All versions of Solaris are not affected. SunOS 4.1.3_U1 and SunOS 4.1.4 are vulnerable. Sun recommends that sites using SunOS 4.1.3_U1 and SunOS 4.1.4 apply the workaround provided in this advisory.
- ---------------------------------------------------------------------------
The CERT Coordination Center staff thanks AUSCERT for permission to republish the information in their advisory AA-96.12. AUSCERT originally thanked Alexander O. Yuriev, the FreeBSD security team, IBM, and the CERT/CC for their assistance in the production of their advisory.
- ---------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (see http://www.first.org/team-info/).
- ----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
and are on call for emergencies during other hours.
Fax +1 412-268-6989
We strongly urge you to encrypt sensitive information sent by email. We can support a shared DES key or PGP. Contact the CERT/CC for more information.
ftp://info.cert.org/pub/CERT_PGP.key
CERT publications and other security information are available from
CERT advisories and bulletins are also posted on the USENET newsgroup
comp.security.announce
To be added to our mailing list for advisories and bulletins, send
email to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
- ---------------------------------------------------------------------------
This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included.
The CERT Coordination Center is part of the Software Engineering Institute (SEI). The SEI is sponsored by the U.S. Department of Defense.
- ---------------------------------------------------------------------------
This file: ftp://info.cert.org/pub/cert_advisories/CA-97.19.bsdlp
http://www.cert.org
click on "CERT Advisories"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
****************************************************************************
* *
* *
* *
* *
* *
* *
* *
* *
****************************************************************************
PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts.
This document was prepared as an service to the DOD
community. Neither the United States Government nor any of their
employees, makes any warranty, expressed or implied, or assumes
any legal liability or responsibility for the accuracy, completeness,
or usefulness of any information, product, or process disclosed,
or represents that its use would not infringe privately owned
rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government.
The opinions of the authors expressed herein do not necessarily
state or reflect those of the United States Government, and shall
not be used for advertising or product endorsement purposes.