ID

VAR-200710-0016

CVE

CVE-2007-5381

TITLE

Cisco IOS LPD Remote Buffer Overflow Vulnerability

DESCRIPTION

Stack-based buffer overflow in the Line Printer Daemon (LPD) in Cisco IOS before 12.2(18)SXF11, 12.4(16a), and 12.4(2)T6 allow remote attackers to execute arbitrary code by setting a long hostname on the target system, then causing an error message to be printed, as demonstrated by a telnet session to the LPD from a source port other than 515. The Cisco IOS Line Printer Daemon contains a buffer overflow vulnerability. If successfully exploited, this vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition . (CSCsj86725)Arbitrary code may be executed. Cisco IOS is prone to a remote buffer-overflow vulnerability in its LPD service because it fails to perform adequate boundary checks on user-supplied data. Attackers could also restart the device, resulting in denial-of-service conditions. To exploit this issue, an attacker must be able to change the hostname of affected routers. SNMP write access may allow attackers to change the router's hostname. Versions prior to Cisco IOS 12.2(18)SXF11, 12.4(16a), and 12.4(2)T6 are vulnerable. This issue is being tracked by Cisco bug ID CSCsj86725. NOTE: This issue is related to the vulnerabilities described in BID 25994 (Cisco IOS Multiple Unspecified Stack Overflow Vulnerabilities). Remote attackers may use this vulnerability to control the device or cause the device to deny service. If any source TCP port other than 515 is connected, the following error will be displayed: $ telnet 172.30.3.101 515 Trying 172.30.3.101... Connected to 172.30.3.101 (172.30.3.101). Escape character is '^]'. hostname_of_the_router: /usr/lib/lpd: Malformed from address If the hostname is greater than or equal to 99 characters, it will overflow due to calling the sprintf() function. Although technically a stack overflow, since IOS allocates heap memory for the process stack, the overwritten memory is actually the heap. Since the heap memory is used as a stack, the hostname can overwrite the return address stored before the start of the character buffer in case of overflow, but for some reason the crash does not occur until the buffer reaches the red zone at the heap block boundary, so After a crash and a router reboot, the memory dump shows heap corruption. The hostname must be controlled to exploit this vulnerability. If SNMP is running on the device and you know the rw community string (usually the default value private), you can set the hostname as follows: $ snmpset -Os -c private -v 1 10.0.0.1 system.sysName.0 s long_hostname. ---------------------------------------------------------------------- Try a new way to discover vulnerabilities that ALREADY EXIST in your IT infrastructure. The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT vulnerabilities in more than 4,700 different Windows applications. Request your account, the Secunia Network Software Inspector (NSI): http://secunia.com/network_software_inspector/ ---------------------------------------------------------------------- TITLE: Cisco IOS Line Printer Daemon Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA27169 VERIFY ADVISORY: http://secunia.com/advisories/27169/ CRITICAL: Not critical IMPACT: DoS, System access WHERE: >From local network OPERATING SYSTEM: Cisco IOS R12.x http://secunia.com/product/50/ Cisco IOS 12.x http://secunia.com/product/182/ DESCRIPTION: Andy Davis has reported a vulnerability in Cisco IOS, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system. This can be exploited to cause a stack-based buffer overflow by e.g. connecting to the default LPD port (515/TCP). Successful exploitation may allow the execution of arbitrary code but requires that the LPD daemon is enabled (disabled by default) and that the attacker can control the hostname of the router. SOLUTION: Update to 12.2(18)SXF11, 12.4(16a), or 12.4(2)T6. PROVIDED AND/OR DISCOVERED BY: Andy Davis, IRM Plc. ORIGINAL ADVISORY: IRM Plc.: http://www.irmplc.com/index.php/155-Advisory-024 Cisco: http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS