Description
The dccscan setuid program in LPPlus does not properly check if the user has the permissions to print the file that is specified to dccscan, which allows local users to print arbitrary files.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- LPPlus 3.2.2/3.3 - dccscan Unprivileged read EDB-20193 · local · Sep 6, 2000 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- lpplus-dccscan-file-read(5201) vdb-entry
- 20000906 Multiple Security Holes in LPPlus mailing-list
- 1644 vdb-entry