Published: 08/01/2000 Updated: 11/07/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sgi irix 6.5
sgi irix 6.5.15f
sgi irix 6.5.15m
sgi irix 6.5.2
sgi irix 6.5.3
sgi irix 6.5.14f
sgi irix 6.5.14m
sgi irix 6.5.18f
sgi irix 6.5.18m
sgi irix 6.5.8
sgi irix 6.5.9
sgi irix 6.5.1
sgi irix 6.5.10
sgi irix 6.5.11
sgi irix 6.5.16f
sgi irix 6.5.16m
sgi irix 6.5.4
sgi irix 6.5.5
sgi irix 6.5.12
sgi irix 6.5.13
sgi irix 6.5.17f
sgi irix 6.5.17m
sgi irix 6.5.6
sgi irix 6.5.7
redhat linux 4.0
redhat linux 4.1
redhat linux 6.0
redhat linux 6.1
redhat linux 4.2
redhat linux 5.0
redhat linux 5.1
redhat linux 5.2

-------------------------------------- linux_lpr_exploitc ---------- #include #include #include #define DEFAULT_OFFSET 50 #define BUFFER_SIZE 1023 long get_esp(void) { __asm__("movl %esp,%eax\n"); } void main() { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; u_char execshell[] = "\x ...

NVD-CWE-Other http://seclists.org/lists/bugtraq/2000/Jan/0116.html http://www.redhat.com/support/errata/RHSA-2000-002.html ftp://patches.sgi.com/support/free/security/advisories/20021104-01-P http://www.kb.cert.org/vuls/id/39001 http://www.securityfocus.com/bid/927 http://www.atstake.com/research/advisories/2000/lpd_advisory.txt http://www.l0pht.com/advisories/lpd_advisory http://www.debian.org/security/2000/20000109 https://exchange.xforce.ibmcloud.com/vulnerabilities/3841 https://nvd.nist.gov https://www.exploit-db.com/exploits/325/

CVE-2000-1220

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect