===========================================================================
              AUSCERT External Security Bulletin Redistribution

            ESB-97.038 -- FreeBSD SA-97.02 Buffer overflow in lpd
                              27 March 1997

===========================================================================

FreeBSD has released the following advisory concerning a vulnerability
in the lpd program under FreeBSD.  This vulnerability may allow remote
users to gain root privileges.

This following security bulletin is provided as a service to AUSCERT's
members.  As AUSCERT did not write this document, AUSCERT has had no
control over its content.  As such, the decision to use any or all of this
information is the responsibility of each user or organisation, and should
be done so in accordance with site policies and procedures.

Contact information for FreeBSD is included in the Security Bulletin
below.  If you have any questions or need further information, please
contact them directly.

If you believe that your system has been compromised, contact AUSCERT or your
representative in FIRST (Forum of Incident Response and Security Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 4477
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
        AUSCERT personnel answer during Queensland business hours
        which are GMT+10:00 (AEST).
        On call after hours for emergencies.

--------------------------BEGIN INCLUDED TEXT--------------------

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-97:02                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          Buffer overflow in lpd

Category:       core
Module:         lpd
Announced:      1997-03-xxx
Affects:        FreeBSD 2.1.7 and earlier and FreeBSD 2.2 snapshots
		before 1997/02/25 suffer from this problem.
Corrected:      FreeBSD-current as of 1997/02/25
		FreeBSD 2.2 as of 1997/02/25
FreeBSD only:   yes

Patches:        ftp://freebsd.org/pub/CERT/patches/SA-97:02/

=============================================================================

I.   Background    

     The lpd program is used to print local and remote print jobs.  It
     is standard software in the FreeBSD operating system.

II.  Problem Description

     The lpd program runs as root.  A remote attacker can exploit a
     buffer overflow to obtain root privs.

III. Impact
     
     Remote users can gain root privs.

IV.  Workaround

     The only workaround is to disable lpd, which will have the effect
     of removing the printing functionality from the system.  Since
     the buffer overflow happens before the connection is authenticated,
     using lpd's authentication methods will not affect the system
     vulnerability.

V.   Solution

     Apply the following patch, rebuild and install libc:

     (This patch can also be found on
	ftp://freebsd.org/pub/CERT/patches/SA-97:02/)

    Index: rcmd.c
    ===================================================================
    RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/net/rcmd.c,v
    retrieving revision 1.3.4.4
    retrieving revision 1.3.4.5
    diff -u -r1.3.4.4 -r1.3.4.5
    --- rcmd.c	1997/02/09 06:57:54	1.3.4.4
    +++ rcmd.c	1997/02/26 06:14:11	1.3.4.5
    @@ -377,7 +377,8 @@
     	if ((hp = gethostbyaddr((char *)&raddr, sizeof(u_long),
     							AF_INET)) == NULL)
     		return (-1);
    -	strcpy(hname, hp->h_name);
    +	strncpy(hname, hp->h_name, sizeof(hname));
    +	hname[sizeof(hname) - 1] = '';
     
     	while (fgets(buf, sizeof(buf), hostf)) {
     		p = buf;

VI.   Thanks

     This problem was brought to light by Oliver Friedrichs
     <oliver@SECNET.COM>.
     
=============================================================================
FreeBSD, Inc.

Web Site:                       http://www.freebsd.org/
Confidential contacts:          security-officer@freebsd.org
PGP Key:                        ftp://freebsd.org/pub/CERT/public_key.asc
Security notifications:         security-notifications@freebsd.org
Security public discussion:     security@freebsd.org

Notice: Any patches in this document may not apply cleanly due to
        modifications caused by digital signature or mailer software.
        Please reference the URL listed at the top of this document
        for original copies of all patches if necessary.
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMzmOqlUuHi5z0oilAQH1hAP/fSVklicjFNo4hLVO2dYLLiIPnB9uVWNl
ocC2Ozu1sX6SH3Kz688QlTEnyDzjshkisI9nr+947A/CjwJDPwqQRbqmbAdI+qka
HNQJmVQYWW2J6j70SJX8q0z1uQHoNsJB7VStQ1VX+4BD91CsjBr3lrU5xFyjqxYt
uJMeNl0sa9A=
=agxY
-----END PGP SIGNATURE-----

--------------------------END INCLUDED TEXT--------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBM0UZhih9+71yA2DNAQEj5gQAiPh1RjnhELNpsWKfAef5l8vKd9WXd5L2
ngAwGllHKb95ayKZ0ss7oreB+NGLcIIEQd5LS+RvPbeDVEm/wOoNNgFuhKoRTPEw
+2KcDXfWmC5DbL8fx6C2K8gZ2YUrv4VKzrJG7/ffjHgbTyMHMHwlsPv+W0eoqi5m
bsPVhbQ3aJg=
=2q0w
-----END PGP SIGNATURE-----