Executive brief
A vulnerability exists in the standard printing utility (lpr) used by many Unix-like operating systems, including Linux and BSD. This flaw allows a person who already has basic access to a computer to gain full administrative control (root access). By exploiting this, an unauthorized user could read sensitive files, modify system settings, or disrupt operations.
Technical details
The lpr utility contains a classic buffer overflow vulnerability within its command-line argument processing. Specifically, the utility fails to perform adequate bounds checking on the string provided to the '-C' (classification) flag. Because lpr is typically installed with setuid root permissions to manage printer spooling, a local attacker can provide a specially crafted, overly long string to overflow the stack buffer and redirect execution flow. This allows for arbitrary code execution with the effective user ID of root, leading to a full local privilege escalation.
Affected products
- BSD BSD-based systems All versions using vulnerable lpr
- Linux Linux Kernel All versions using vulnerable lpr
Timeline
- 1996-10-25: disclosed: Initial publication date in NVD