A local overflow exists in multiple operating systems. The line printer daemon (lpd) fails to correctly parse an incomplete print job request, resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity.

This vulnerability is only present when a malicious attacker can attack from a system that is listed in the "/etc/hosts.equiv" or "/etc/hosts.lpd" file of the target system.

Upgrade to FreeBSD version 4.3-STABLE or to the RELENG_4_3 security branch after the respective correction date or higher, as it has been reported to fix this vulnerability. In addition, FreeBSD has released patches for some older versions. It is also possible to correct the flaw by implementing the following workaround: killall lpd.

Upgrade to NetBSD version 1.5.2 after the respective correction date or higher, as it has been reported to fix this vulnerability. In addition, NetBSD has released patches for some older versions. It is also possible to correct the flaw by implementing the following workaround: killall lpd and/or edit /etc/hosts.lpd to prevent remote connections to lpd.

OpenBSD has released a patch for some older versions.

Caldera/SCO has released patches for some older versions.

IBM has released a patch for some older versions.

Redhat has released patches for some older versions.

SuSE has released patches for some older versions.

• CVE ID: 2001-0670 (see also: NVD)
• CERT VU: 274043
• Bugtraq ID: 3252
• ISS X-Force ID: 7046
• CERT: CA-2001-30
• Vendor Specific Advisory URL: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:58.lpd.asc ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-018.txt.asc ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.20.1/CSSA-2001-SCO.20.1.txt http://archives.neohapsis.com/archives/bugtraq/2001-09/0084.html
  http://rhn.redhat.com/errata/RHSA-2001-147.html
  http://www.openbsd.com/errata29.html
  http://www.securityfocus.com/advisories/3589
• Vendor Specific Solution URL: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:58/lpd-3.x-4.2.patch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:58/lpd-3.x-4.2.patch.asc ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:58/lpd-4.3.patch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:58/lpd-4.3.patch.asc ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-018-lpd.patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/017_lpd.patch ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.20.1/
• CIAC Advisory: l-137 m-014

• ISS X-Force Research - xforceiss.net - Internet Security Systems