CVE-2008-0621: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the 1 0x01, 2 0x02, 3 0x03, 4 0x04, and 5 0x05 LPD commands...

SCO_lpr_vuln.txt

Subject: SCO 5.0.5 lpr local root exploit To: [email protected] Greetings, There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more accurately, /usr/lpd/remote/lp, which lpr execs and passes your command line args on to. This means that while /usr/bin/lpr is sgid lp, we'll stil...