critical10.0Public exploit code
CVE-2001-1583
lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not pr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Solaris 2.x/7.0/8 LPD - Remote Command Execution2001-08-31 · remote · solaris · Verified
- Solaris LPD - Command Execution (Metasploit)2010-09-20 · remote · solaris · Verified
- Solaris 8.0 LPD - Command Execution (Metasploit)2001-08-31 · remote · solaris · Verified
- Solaris 10 LPD - Arbitrary File Delete (Metasploit)2005-08-19 · remote · solaris · Verified
Impact
lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sun | Sunos | through 5.9 |
Weakness classification
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=99929694701826&w=2
- http://metasploit.com/projects/Framework/modules/exploits/solaris_lpd_exec.pm
- http://www.derkeiler.com/Mailing-Lists/securityfocus/incidents/2001-08/0490.html
- http://www.osvdb.org/15131
- http://www.securityfocus.com/bid/3274
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7087
- http://marc.info/?l=bugtraq&m=99929694701826&w=2
- http://metasploit.com/projects/Framework/modules/exploits/solaris_lpd_exec.pm
- http://www.derkeiler.com/Mailing-Lists/securityfocus/incidents/2001-08/0490.html
- http://www.osvdb.org/15131
- http://www.securityfocus.com/bid/3274
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7087