Description
Stack-based buffer overflow in the Line Printer Daemon (LPD) in Cisco IOS before 12.2(18)SXF11, 12.4(16a), and 12.4(2)T6 allow remote attackers to execute arbitrary code by setting a long hostname on the target system, then causing an error message to be printed, as demonstrated by a telnet session to the LPD from a source port other than 515.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cisco IOS 12.3 - 'LPD' Remote Buffer Overflow EDB-30652 · remote · Oct 10, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20071010 Cisco IOS Line Printer Daemon (LPD) Protocol Stack Overflow vendor-advisory
- 37935 vdb-entry
- 27169 third-party-advisory
- ADV-2007-3457 vdb-entry
- cisco-ios-lpd-bo(37046) vdb-entry
- http://www.irmplc.com/index.php/155-Advisory-024
- VU#230505 third-party-advisory
- 1018798 vdb-entry
- 26001 vdb-entry