Vulnerability Development: Re: lpd exploit?

[Jarno Huuskonen <jhuuskon () MESSI UKU FI>]

On Thu, Nov 30, Mark wrote:
> This is paranoia.  By default, redhat 7 runs lpd as user 'lp', and I have
> never seen any exploits for this daemon.
>
> mark
> tort () dethbystereo com
Well, Chris Evans reported an LPRng format string vulnerability on bugtraq
(see http://www.securityfocus.com/archive/1/85002 ). From the report
you can see that LPRng doesn't fully drop root privileges, so maybe
the exploit is more than paranoia.

-Jarno

PS. I think that Chris Wing has made a patch for LPRng so it'll fully drop
    root privileges (uses kernel capabilities). See
    http://www.engin.umich.edu/caen/systems/Linux/caenlinux/6.1/changes.html

--
Jarno Huuskonen - System Administrator   |  Jarno.Huuskonen () uku fi
University of Kuopio - Computer Centre   |  Work:   +358 17 162822
PO BOX 1627, 70211 Kuopio, Finland       |  Mobile: +358 40 5388169