CVE-2000-1220 The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as...
HighCVSS 10.0
EPSS 14.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sgi irix | = 6.5 | No fix listed |
| sgi irix | = 6.5.1 | No fix listed |
| sgi irix | = 6.5.2 | No fix listed |
| sgi irix | = 6.5.3 | No fix listed |
| sgi irix | = 6.5.4 | No fix listed |
| sgi irix | = 6.5.5 | No fix listed |
| sgi irix | = 6.5.6 | No fix listed |
| sgi irix | = 6.5.7 | No fix listed |
| sgi irix | = 6.5.8 | No fix listed |
| sgi irix | = 6.5.9 | No fix listed |
| sgi irix | = 6.5.10 | No fix listed |
| sgi irix | = 6.5.11 | No fix listed |
| sgi irix | = 6.5.12 | No fix listed |
| sgi irix | = 6.5.13 | No fix listed |
| sgi irix | = 6.5.14f | No fix listed |
| sgi irix | = 6.5.14m | No fix listed |
| sgi irix | = 6.5.15f | No fix listed |
| sgi irix | = 6.5.15m | No fix listed |
| sgi irix | = 6.5.16f | No fix listed |
| sgi irix | = 6.5.16m | No fix listed |
| sgi irix | = 6.5.17f | No fix listed |
| sgi irix | = 6.5.17m | No fix listed |
| sgi irix | = 6.5.18f | No fix listed |
| sgi irix | = 6.5.18m | No fix listed |
| redhat linux | = 4.0 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat linux | = 4.1 | No fix listed |
| redhat linux | = 4.2 | No fix listed |
| redhat linux | = 5.0 | No fix listed |
| redhat linux | = 5.1 | No fix listed |
| redhat linux | = 5.2 | No fix listed |
| redhat linux | = 6.0 | No fix listed |
| redhat linux | = 6.1 | No fix listed |
| debian/lpr(Debian:12) | < 1:0.48-1 | 1:0.48-1 |
| debian/lpr(Debian:14) | < 1:0.48-1 | 1:0.48-1 |
| debian/lpr(Debian:13) | < 1:0.48-1 | 1:0.48-1 |
References
- 20000108 L0pht Advisory: LPD, RH 4.x,5.x,6.x mailing-list
- www.atstake.com
- 20000109 lpr -- access control problem and root exploit vendor-advisory
- VU#39001 third-party-advisory us-government-resource
- 20000108 Quadruple Inverted Backflip vendor-advisory
- RHSA-2000:002 vendor-advisory
- 927 vdb-entry
- redhat-lpd-print-control(3841) vdb-entry
- Debian Security Tracker CVE-2000-1220 vendor-advisory