CVE-2003-0144

Current Description

Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.

Basic Data

Published	March 31, 2003
Last Modified	July 11, 2017
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	NVD-CWE-Other
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS 2 - Access Vector	LOCAL
CVSS 2 - Access Complexity	LOW
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	COMPLETE
CVSS 2 - Availability Impact	COMPLETE
CVSS 2 - Base Score	7.2
Severity	HIGH
Exploitability Score	3.9
Impact Score	10.0
Obtain All Privilege	true
Obtain User Privilege	false
Obtain Other Privilege	false

Base Metric V3

No data provided.

Configurations

OR - Configuration 1

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Lprold	Lprold	3.0.48	*	*	*	*	*	*	*

OR - Configuration 2

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Bsd	Lpr	0.48	*	*	*	*	*	*	*
2.3	OS	Bsd	Lpr	2000-05-07	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2.2	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2.3	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2.4	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2.5	*	*	*	*	*	*	*
2.3	OS	Freebsd	Freebsd	2.2.6	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.0	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.1	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.2	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.3	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.4	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.5	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.6	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.7	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.8	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	2.9	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	3.0	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	3.1	*	*	*	*	*	*	*
2.3	OS	Openbsd	Openbsd	3.2	*	*	*	*	*	*	*

Vulnerable Software List

Vendor	Product	Versions
Freebsd	Freebsd	2.2, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6
Openbsd	Openbsd	2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2
Lprold	Lprold	3.0.48
Bsd	Lpr	0.48, 2000-05-07

References

Name	Source	URL	Tags
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/010_lprm.patch	ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/010_lprm.patch	CONFIRM
20030406-02-P	ftp://patches.sgi.com/support/free/security/advisories/20030406-02-P	SGI
20030305 potential buffer overflow in lprm (fwd)	http://marc.info/?l=bugtraq&m=104690434504429&w=2	BUGTRAQ
20030308 OpenBSD lprm(1) exploit	http://marc.info/?l=bugtraq&m=104714441925019&w=2	BUGTRAQ
8293	http://secunia.com/advisories/8293	SECUNIA
DSA-267	http://www.debian.org/security/2003/dsa-267	DEBIAN
DSA-275	http://www.debian.org/security/2003/dsa-275	DEBIAN
MDKSA-2003:059	http://www.mandriva.com/security/advisories?name=MDKSA-2003:059	MANDRAKE
SuSE-SA:2003:0014	http://www.novell.com/linux/security/advisories/2003_014_lprold.html	SUSE
7025	http://www.securityfocus.com/bid/7025	BID	Exploit PATCH Vendor Advisory
lprm-bo(11473)	https://exchange.xforce.ibmcloud.com/vulnerabilities/11473	XF