SUBJECT: Vulnerability in the BSD "lpr" Utility Under IRIX.
SUMMARY: A security vulnerability exists in certain versions of lpr running on Silicon Graphics, Inc. (SGI) workstations running certain versions of the IRIX operating system.
BACKGROUND: All SGI workstations that are running IRIX 4.0.5 (all versions) or IRIX 5.x (5.0, 5.0.1, 5.1.* and 5.2) and that have the BSD lpr spooling system installed are vulnerable to this problem. Note: SGI systems normally use the standard AT&T System V lp print spooling mechanism, not the BSD lpr subsystem (eoe2.sw.bsdlpr).
IMPACT: Any user with access to lpr(1) can gain root privileges.
RECOMMENDED SOLUTION: Install corrected versions of the lpr software. The new lpr software developed by SGI can be obtained via anonymous FTP from ftp.sgi.com in the following files:
IRIX 4.0.5 systems: ~ftp/sgi/IRIX4.0/lpr/lpr.latest.Z for IRIX 5.x systems: ~ftp/sgi/IRIX5.0/lpr/lpr.latest.Z
Checksumming (command "sum -r lpr*") the uncompressed files should give the following results:
IRIX 4.0.5: 43017 82 lpr.latest.Z
64205 167 lpr.new
63777 4 lpr.new.install
IRIX 5.x: 61762 44 lpr.latest.Z
22489 81 lpr.new
63777 4 lpr.new.install
ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. If you are a constituent of the DoD and have any questions about ASSIST or computer security issues, contact ASSIST using one of the methods listed below. If your organization/institution is non-DoD, contact your Forum of Incident Response and Security Teams (FIRST) representative. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts".
ASSIST INFORMATION RESOURCES: If you would like to be included in the distribution list for these bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.ims.disa.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-756-7993/ 1154 DSN 289, and through anonymous FTP from assist.ims.disa.mil (IP address 137.130.234.30). Note: assist.ims.disa.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS.
ASSIST contact information:
PHONE: 703-756-7974, DSN 289, duty hours are 06:00 to 22:30 EST Monday through Friday. During off duty hours, weekends, and holidays, ASSIST can be reached via pager at 800-SKY-PAGE (800-759-7243) PIN 2133937. Your page will be answered within 30 minutes, however if a quicker response is required, prefix your phone number with "999".
ELECTRONIC MAIL: Send to assist@assist.ims.disa.mil. ASSIST BBS: Leave a message for the "sysop".
Privacy Enhanced Mail (PEM): ASSIST uses PEM, a public key encryption tool, to digitally sign all bulletins that are distributed through e-mail. The section of seemingly random characters between the "BEGIN PRIVACY-ENHANCED MESSAGE" and "BEGIN ASSIST BULLETIN" contains machine-readable digital signature information generated by PEM, not corrupted data. PEM
software for UNIX systems is available from Trusted Information Systems (TIS) at no cost, and can be obtained via anonymous FTP from ftp.tis.com (IP 192.94.214.100). Note: The TIS software is just one of several implementations of PEM currently available and additional versions are likely to be offered from other sources in the near future.
Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for adverstising or product endorsement purposes.