Vulnerability

CERT-In Vulnerability Note CIVN-2003-0009
lpd format string vulnerability in AIX

Original Issue Date:September 22, 2003

Severity Rating: LOW

Systems Affected

AIX 4.3, 5.1 and 5.2

Overview

A local attacker can gain root privileges or cause a denial of service by exploiting lpd format string vulnerability

Impact

A local user in the printq group can get root privileges causing the print server to deny service to the other clients

Description

lpd i.e. Line Printer Daemon that is shiped with AIX provides the remote print server on a network. A format string vulnerability has been detected which allows the local attacker to gain root privileges. If the local user has a printq group privileges then the user can easily get the root privileges. lpd is shipped as a part of bos.rte.printers fileset. In order to determine the information, version,etc. of the this daemon issue the command as:
# lslpp -L bos.rte.printers
This command will give a detailed listing of this daemon.

Workaround

Incase the lpd daemon is not required then the users could remove this fileset by using SMIT command or by issuing the command as
# installp -u bos.rte.printers

Solution

Incase lpd daemon is required then the users need to apply the following APARs
APAR number for AIX 4.3.3: IY45250 available on
http://techsupport.services.ibm.com/rs6k/fixdb.html
APAR number for AIX 5.1.0: IY46256 available on

http://techsupport.services.ibm.com/server/aix.fdc
APAR number for AIX 5.2.0: IY45344 available on

http://techsupport.services.ibm.com/server/aix.fdc
For the versions below 4.3.3, it is advisable to ugrade the system to either 4.3.3 or 5.1.0 or 5.2.0

Vendor Information

IBM SECURITY ADVISORY: Issued on September 15 09:25:56 CDT 2003.
This security advisory can be obtained on the www.ibm.com website by subscribing to

https://techsupport.services.ibm.com/

References

CAN-2003-0697
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0697

CVE Name

CAN-2003-0697

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India