Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2000-1221 — Linux vulnerability
9 documents8 sources
Severity
10.0CRITICALNVD
EPSS
10.9%
top 6.61%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 8
Latest updateMay 3
Description
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by modifying the DNS for the attacking IP.
CVSS vector
AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0
Affected Packages2 packages
Also affects: Debian Linux 2.1
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-7g6p-865f-j3r5: The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the l↗2022-05-03
CVEList▶
CVE-2000-1221: The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the l↗2005-04-21
OSV▶
CVE-2000-1221: The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the l↗2000-01-08