exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

IRM-CiscoLPD.txt

IRM-CiscoLPD.txt
Posted Oct 11, 2007
Site irmplc.com

IRM Security Advisory 024 - The Line Printer Daemon, which provides print server functionality in Cisco IOS, is vulnerable to a software flaw whereby the length of the hostname of the router is not checked before being copied into a fixed size memory buffer.

tags | advisory
systems | cisco
SHA-256 | c3d16146d2b31bf0699e2084a8907b064711cb6be0decdda1b93a7b85b71b983

IRM-CiscoLPD.txt

Change Mirror Download
----------------------------------------------------------------------

IRM Security Advisory 024



Cisco IOS LPD Remote Stack Overflow



Vulnerability Type / Importance: Remote Code Execution / High



Problem Discovered: 30 July 2007

Vendor Contacted: 30 July 2007

Advisory Published: 10 October 2007

----------------------------------------------------------------------



Abstract:



The LPD daemon included in Cisco IOS is vulnerable to a remote stack
overflow



Description:



The Line Printer Daemon, which provides print server functionality in
Cisco IOS is vulnerable to a software flaw whereby the length of the
hostname of the router is not checked before being copied into a fixed
size memory buffer. This results in IOS crashing if the hostname is too
long, but could potentially result is arbitrary code execution. However,
the attacker must be able to control the hostname of the router, which

could be achieved via SNMP.



Technical Details:



When the LPD daemon is configured in Cisco IOS it listens on the default
LPD TCP port, 515. If connected to with a source TCP port of anything
other than 515 the following error is displayed:



$ telnet 172.30.3.101 515

Trying 172.30.3.101...

Connected to 172.30.3.101 (172.30.3.101).

Escape character is '^]'.

hostname_of_the_router: /usr/lib/lpd: Malformed from address



If the hostname is 99 characters or longer then the overflow occurs as
the result of a call to the sprintf() function. Although this is
technically a stack overflow, because IOS allocates heap memory for
process stacks, the memory overwritten is actually heap. However, as the
heap memory is acting as a stack, the return address, stored before the
start of the character buffer, can be overwritten by the hostname when
the overflow occurs, but for some reason the crash doesn't occur until
the buffer intrudes into the "red zone" at the boundary of the heap
chunk. Therefore, when the crash happens and the router reboots, the
memory dump indicates heap corruption.



It must be reiterated that control of the hostname is required to
exploit this vulnerability. If SNMP is running on the device and the
"read/write" community string is known (this is often set to the default
value "private") then the hostname can be set as follows:



$ snmpset -Os -c private -v 1 10.0.0.1 system.sysName.0 s long_hostname



Vendor & Patch Information:



Cisco has released an update to resolve this issue; this can be
downloaded from:



http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml



Workaround:



Cisco has provided the following workaround to mitigate this

vulnerability:



http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml



Tested/Affected Versions:



IRM identified this vulnerability in IOS version 12.3(22)



Credits:



Research & Advisory: Andy Davis



Disclaimer:



All information in this advisory is provided on an 'as is' basis in the
hope that it will be useful. Information Risk Management Plc is not
responsible for any risks or occurrences caused by the application of
this information.



www.irmplc.com





Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    69 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close