BSD lpd vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----


===========================================================================
              AUSCERT External Security Bulletin Redistribution

                             
                     ESB-97.128 -- SNI Security Advisory
			  BSD lpd vulnerabilities
                              6 October 1997

===========================================================================

Secure Networks Inc.  has released the following advisory concerning a
number of vulnerabilities in the BSD line printer daemon (lpd).  These
vulnerabilities may allow local and remote users, with access to a
privileged port on a valid client system, to create and remove files and
execute commands on the print server.

The following security bulletin is provided as a service to AUSCERT's
members.  As AUSCERT did not write this document, AUSCERT has had no
control over its content.  As such, the decision to use any or all of this
information is the responsibility of each user or organisation, and should
be done so in accordance with site policies and procedures.

Contact information for SNI is included in the Security Bulletin below.
If you have any questions or need further information, please contact them
directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/information/advisories.html

If you believe that your system has been compromised, contact AUSCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 4477
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
	AUSCERT personnel answer during Queensland business hours
	which are GMT+10:00 (AEST).
	On call after hours for emergencies.


- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

                        #####   ##   ##   ######
                        ##      ###  ##     ##
                        #####   ## # ##     ##
                           ##   ##  ###     ##
                        ##### . ##   ## . ###### .

                           Secure Networks Inc.

                            Security Advisory
                             October 2, 1997

                          BSD lpd vulnerabilities


This advisory addresses a number of vulnerabilities present in the
BSD line printer daemon (lpd).  These vulnerabilities can enable a
remote individual to create and remove arbitrary files, as well as
enabling remote individuals to obtain shell access as the user
which lpd runs as.


Problem Descriptions
~~~~~~~~~~~~~~~~~~~~

Problem 1: File creation

Individuals with access to the line printer daemon from a privileged
port on a valid print client can tell lpd to create a file, providing
the name of the file, including directory names, is no longer than 5
characters.

Problem 2: File deletion

Individuals with access to the line printer daemon from a privileged
port on a valid print client can tell lpd to remove any file on the
system.

Problem 3: Remote execution

Individuals with access to the line printer daemon from a privileged
port on a valid print client can execute commands remotely as the
user which lpd is running as.  This vulnerability can allow
interactive shell access to the remote system.


A privileged port on a valid client system is required to exploit
all of these vulnerabilities.  A privileged port can be obtained on
many operating systems by utilizing another vulnerability present in
the file transfer protocol daemon (ftpd).  This vulnerability is
commonly known as the "FTP bounce" attack, and allows data to be
sent to any internet address and port, originating from the FTP
data port (20).


Technical Details
~~~~~~~~~~~~~~~~~

Problem 1: File creation

BSD derived lp daemons support a feature to allow remote print clients
to transfer control files and files to be printed, to the print server.
These files are created in the printer daemon spool directory.

This problem is present due to the fact that lpd fails to validate the
name of files being uploaded by print clients.  By specifying an explicit
path, an attacker can create files on a remote server.  This problem
allows an attacker to specify a total of 5 characters in the path
and name of the file.


Problem 2: File deletion

This problem uses the technique described in problem #1.  An attacker
has the ability to create lpd control files.  lpd control files support
various functions such as specifying a file to print and removal of
files.  Any file which is sent to the remote print daemon which begins
with "cf" will be treated as a control file.  By uploading a control
file which utilizes the removal feature, any system file can be
removed from the print server.


Problem 3: Remote Execution

This problem uses the technique described in problem #1.  By uploading
a lpd control file, the attacker can cause lpd to send mail to the
user specified in the control file, confirming their print job.  When
lpd sends mail, it specifies the username which was inserted into the
control file, on the sendmail command line.  By specifying a sendmail
command line option rather than a username, the attacker can cause
sendmail to utilize an alternate configuration file when it is invoked.

An alternate sendmail configuration file can be transferred to the
remote system via anonymous FTP, or Problem #1.


Impact
~~~~~~

If anonymous FTP is enabled on a valid print client, and the print
client is vulnerable to the FTP bounce attack, then individuals can
create and remove files on the print server, and execute commands on
the print server.

If anonymous FTP is not enabled on any print client, but the FTP
server is vulnerable to the FTP bounce attack, then any user with
a valid FTP account can create and remove files on the print server,
and execute commands on the print server.

If no valid print clients are vulnerable to the FTP bounce attack, then
a user with root privileges on any valid print client can create and
remove files on the print server, and execute commands on the print
server.


Vulnerable Systems
~~~~~~~~~~~~~~~~~~

BSD/OS 2.1 and 3.0 (BSDI):

  The BSD/OS print system is not configured by default, therefore
  all vulnerabilities apply ONLY if the system has been configured
  as a print server.

  The BSD/OS lpd is vulnerable to all three problems if printing
  has been enabled.

  The lpd shipped with BSD/OS accepts connections from the FTP
  daemon, allowing attackers to utilize the FTP bounce attack.

  BSD/OS is vulnerable to problem 3 (remote execution) only if
  the attacker has the ability to upload a world readable file
  to the remote server.


FreeBSD:

  The FreeBSD print system is not configured by default, therefore
  all vulnerabilities apply ONLY if the system has been configured
  as a print server.

  In 2.1.7 and 2.2.2, the ftpd shipped does NOT permit the ftp
  bounce attack.

  In 2.1.7 and 2.2.2, the lpd shipped does not permit connections from
  the FTP daemon.

  Current versions of FreeBSD are vulnerable only if the attacker has
  super-user access on a valid print client.


Linux:

  Many Linux distributions have lpd configured by default and
  permit "localhost" to use the print service.

  The Linux lpd is vulnerable to all three problems if printing
  has been enabled.

  The lpd shipped with Linux accepts connections from the FTP
  daemon, allowing attackers to utilize the FTP bounce attack.

  The ftpd shipped with some Linux versions permits the FTP bounce
  attack.  To determine your ftpd version, issue the command:

  % telnet localhost 21

  If you see: 'wu-ftpd-2.4.2-academ[BETA-13]' then you are NOT
  vulnerable to FTP bounce attacks.  If you do not see
  'academ[BETA-13]' in the ftpd version string, then there is
  a high possibility that you are vulnerable to FTP bounce attacks.

  Linux is vulnerable to problem 3 (remote execution) only if
  the attacker has the ability to upload a world readable file
  to the remote print server.


OpenBSD 2.1:

  The OpenBSD print system is not enabled by default.

  The OpenBSD lpd does not permit connections from the FTP daemon.

  OpenBSD ftpd is not vulnerable to ftp bounce attacks.

  OpenBSD is vulnerable only if the attacker has super-user access
  to a valid print client.

  OpenBSD is vulnerable to problem 3 (remote execution) only if
  the attacker has the ability to upload a world readable file
  to the remote print server.

  OpenBSD-current has all of the above problems fixed.


Fix Information
~~~~~~~~~~~~~~~

There are several solutions which can serve as a workaround for this
problem.

i.   Installing a FTP daemon which prevents ftp bounce.  This FTP
     daemon should be installed on all print clients to prevent non-root
     users from obtaining a privileged port to connect to the print
     daemon with.

     A freely available FTP daemon which prevents users from sending
     data to privileged ports is the Academ wu-ftpd variant, currently
     in beta.

     You can obtain a copy of this ftpd at:

     ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-15.tar.Z

     Installing this alternate FTP daemon will limit the above attacks,
     however will still allow an attacker who has super-user access on
     a valid print client to exploit these problems.

ii.  Modify your print daemon to reject connections from the ftp-data
     port (port 20).

iii. Disable print services until a suitable fix has been made availible
     for your operating system.

iv.  Install a fixed version of the BSD print software.  A fixed version
     of the BSD print software is availible at the following ftp site:

     ftp://ftp.secnet.com/pub/patches/lpd.tar.gz

     This package fixes numerous other problems present in the BSD
     printing suite, including numerous buffer overflows present in both
     the client programs and the server.  This package has been
     provided by OpenBSD.

v.   Contact your vendor for patch information.


Additional Information
~~~~~~~~~~~~~~~~~~~~~~

The file deletion problems in lpd were discovered by Hiroshi Nakano
<nakano@rins.ryukoku.ac.jp>

The remote execution problem which enables attackers to execute
commands as the lpd user was discovered by Oliver Friedrichs
<oliver@secnet.com>

For additional information about FTP bounce attacks, please see
ftp://ftp.sterling.com/mirrors/avian.org/random/ftp-attack

You can subscribe to our security advisory mailing list by sending
mail to majordomo@secnet.com, containing the single line
subscribe sni-advisories

You can find Secure Networks papers at ftp://ftp.secnet.com/pub/papers
and advisories at ftp://ftp.secnet.com/pub/advisories

You can contact Secure Networks Inc. at <sni@secnet.com> using
the following PGP key:

Type Bits/KeyID    Date       User ID
pub  1024/9E55000D 1997/01/13 Secure Networks Inc. <sni@secnet.com>
                              Secure Networks <security@secnet.com>

- - -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3ia

mQCNAzLaFzIAAAEEAKsVzPR7Y6oFN5VPE/Rp6Sm82oE0y6Mkuof8QzERV6taihn5
uySb31UeNJ4l6Ud9alOPT/0YdeOO9on6eD1iU8qumFxzO3TLm8nTAdZehQSAQfoa
rWmpwj7KpXN/3n+VyBWvhpBdKxe08SQN4ZjvV5HXy4YIrE5bTbgIhFKeVQANAAUR
tCVTZWN1cmUgTmV0d29ya3MgSW5jLiA8c25pQHNlY25ldC5jb20+iQCVAwUQM1yd
EB/bLKAOe7p9AQFptAQAiYpaZCpSmGgr05E698Z3t5r5BPAKUEtgvF53AvZUQLxz
ZsYsVU5l5De0qKWJOQ/9LiDyWu1lvKhlTphbLy2RatWD4kO3oQL9v3TpSXm2WQhU
uIzyZvj7S5ENodNnKn+gCDIvbou6OMot+7dRbWWgN2oabbru4CSlOxbG++yaTz+J
AJUDBRAzTefbtOXez5VgyLkBAd0bA/43eGEgvPOFK+HHWCPpkSWCwtrtDU/dxOVz
9erHnT/CRxeojCI+50f71Qe+kvx9Q1odz2Jl/fLxhnPQdbPnpWblIbu4F8H+Syrj
HTilDrl1DWa/nUNgK8sb27SMviELczP1a8gwA1eo5SUCG5TWLLTAzjWOgTxod2Ha
OwseUHmqVIkAlQMFEDNOVsr/d6Iw8NVIbQEBxM0D/14XRfgSLwszgJcVbslMHm/B
fF6tHoWYojzQle3opOuMYHNN8GsMZRkc1qQ8QuNA9Aj5+qDqEontGjV5IvhBu1fY
FM77AhagskaFCZxwqV64Qrk328WDO89NGSd+RuovVNruDdn20TxNCEVuPTHjI0UA
8H+E6FW9jexg6RTHhPXYtCVTZWN1cmUgTmV0d29ya3MgPHNlY3VyaXR5QHNlY25l
dC5jb20+iQCVAwUQMtqTKB/bLKAOe7p9AQFw5wQAgUwqJ+ZqfEy/lO1srU3nzxLA
X0uHGHrMptRy/LFo8swD6G1TtWExUc3Yv/6g2/YK09b5WmplEJ+Q09maQIw+RU/s
cIY+EsPauqIq4JTGh/Nm0Z4UDl2Y1x4GNtm0YqezxUPS0P0A3LHVLJ3Uo5og0G8O
gPNrfbVz5ieT14OSCWCJAJUDBRAy2hd2/3eiMPDVSG0BAVNhBACfupfAcNhhnQaq
aI03DOOiZSRjvql1xw4V+pPhM+IksdSK3YNUZVJJtANacgDhBT+jAPRaYbBWI3A5
ZMdcSNM8aTG0LWMLIOiOYEm6Lgd3idRBFN0Js08eyITl8mhZ33mDe4I0KQri9UiV
ZcPYTbb9CWM6Hv2cMbt6S6kLnFziqIkAlQMFEDLaF0+4CIRSnlUADQEBCLoEAJwt
UofDgvyZ4nCDx1KKAPkkXBRaPMWBp46xeTVcxaYiloZfwHfpk1h2mEJAxmAsvizl
OtIppHl4isUxcGi/E2mLCLMvis22/IQP/9obPahPvgNaMLVtZljO1Nv3QFEkNciL
FEUTNJHR1ko7ibCxkBs4cOpirFuvTMDvWnNaXAf8
=DchE
- - -----END PGP PUBLIC KEY BLOCK-----

Copyright Notice
~~~~~~~~~~~~~~~~
The contents of this advisory are Copyright (C) 1997 Secure Networks Inc,
and may be distributed freely provided that no fee is charged for
distribution, and that proper credit is given.

 You can find Secure Networks papers at ftp://ftp.secnet.com/pub/papers
 and advisories at ftp://ftp.secnet.com/advisories

 You can browse our web site at http://www.secnet.com

 You can subscribe to our security advisory mailing list by sending mail to
 majordomo@secnet.com with the line "subscribe sni-advisories"


- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBNDRHjrgIhFKeVQANAQE5uAQAlaKLZBK2CC3YbkXy6CQOkQpj8ENIFx2P
ruPcu3ybBTsnCKNFjSKK/NYJPTIgAPixFcevKPx1JmDO9nR8RaYZakpl1wxI6Xin
c7NdMnQQBpZQr3AMapI6e9BniDPCWL8x83quIhbQFFgNgYPXYEPDXSkwsY2BObT/
SJ8sWo4k4fQ=
=dwHs
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBND3uJSh9+71yA2DNAQGX6gP8CXCcj6NFH2W5Apit3yVht7kALORdneDc
emZFz0T9jG6Af4mRslz/BHM0Z9qlaqB0COex2A45kCQRF35pvRN8vEgEr0K8EBUJ
zrTvQA/1xDVrPy+58mXX3/3hAQCIKYoBPEzBZ2tXSlDdh71E52q9vxwQ5+KAbAnI
1MEdPVx84lE=
=qpYG
-----END PGP SIGNATURE-----