SAPlpd Memory Corruption Bugs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019300 |
|
SecurityTracker URL: http://securitytracker.com/id/1019300
|
|
CVE Reference:
CVE-2008-0620, CVE-2008-0621
(Links to External Site)
|
Updated: Feb 7 2008
|
Original Entry Date: Feb 4 2008
|
Impact:
Execution of arbitrary code via network, User access via network
|
Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 6.28 and prior versions
|
Description:
Luigi Auriemma reported vulnerabilities in SAPlpd. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to the target line printer daemon on port 515 to trigger any of several memory corruption errors and execute arbitrary code on the target system. The code will run with the privileges of the target service.
The vulnerable utility is included in SAP GUI version 7.10.
Some demonstration exploit code is available at:
http://aluigi.org/poc/saplpdz.zip
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
No solution was available at the time of this entry.
The vendor is working on a fix.
|
Vendor URL: www.sap.com/ (Links to External Site)
|
Cause:
Access control error, Boundary error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 4 Feb 2008 22:32:59 +0100
Subject: Multiple vulnerabilities in SAPlpd 6.28
|
#######################################################################
Luigi Auriemma
Application: SAPlpd
http://www.sap.com
Versions: <= 6.28 (included in SAP GUI 7.10)
Platforms: Windows
Bugs: various vulnerabilities
Exploitation: remote
Date: 04 Feb 2008
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
SAPlpd is a small and very old (2001) line printer daemon for Windows
which is included in the SAP GUI package.
#######################################################################
=======
2) Bugs
=======
The daemon is affected by various vulnerabilities which, for brevity,
I have decided to list through the lpd commands (in hex) accepted by
the program:
commands type of bug
01 31 memcpy
02 32 memcpy + sprintf "Receive job for printer %s (berkley protocol)\n"
03 04 33 34 sprintf "QUERY = %s\n" + multiple strcpy
05 35 multiple strcpy
53 server termination
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/saplpdz.zip
#######################################################################
======
4) Fix
======
Vendor contacted, a patch will be released soon.
#######################################################################
---
Luigi Auriemma
http://aluigi.org
|
|
