Company

Technical Security Consulting

Managing Risk

Research & Development

Forensics

Security Management

Media Centre

PCI DSS

• Home
• Overview
• R&D Services
• Technology Focus
• Messaging Systems Security
• Embedded Systems Security
• Collaborative Research Projects
• Technical Whitepapers
• Research Briefings
• Publicly Released Tools
• Vendor Alerts - 0days
• Security Advisories
• Advisories
• Advisory 026
• Advisory 025
• Advisory 024
• Advisory 023
• Advisory 022
• Advisory 021
• Advisory 020
• Advisory 019
• Advisory 018
• Advisory 017
• Advisory 016
• Advisory 015
• Advisory 014
• Advisory 013
• Advisory 012
• Advisory 011
• Advisory 010
• Advisory 009
• Advisory 008
• Advisory 007
• Advisory 006
• Advisory 005
• Advisory 004
• Advisory 003
• Advisory 002
• Advisory 001

Advisory 024

Cisco IOS LPD Remote Stack Overflow

Vulnerability Type / Importance: Remote Code Execution / High

Problem Discovered: 30 July 2007

Vendor Contacted: 30 July 2007

Advisory Published: 10 October 2007

Abstract:

The LPD daemon included in Cisco IOS is vulnerable to a remote stack overflow

Description:

The Line Printer Daemon, which provides print server functionality in Cisco IOS is vulnerable to a software flaw whereby the length of the hostname of the router is not checked before being copied into a fixed size memory buffer. This results in IOS crashing if the hostname is too long, but could potentially result is arbitrary code execution. However, the attacker must be able to control the hostname of the router, which could be achieved via SNMP.   

Technical Details:

When the LPD daemon is configured in Cisco IOS it listens on the default LPD TCP port, 515. If connected to with a source TCP port of anything other than 515 the following error is displayed:

$ telnet 172.30.3.101 515

Trying 172.30.3.101...

Connected to 172.30.3.101 (172.30.3.101).

Escape character is '^]'.

hostname_of_the_router: /usr/lib/lpd: Malformed from address

If the hostname is 99 characters or longer then the overflow occurs as the result of a call to the sprintf() function. Although this is technically a stack overflow, because IOS allocates heap memory for process stacks, the memory overwritten is actually heap. However, as the heap memory is acting as a stack, the return address, stored before the start of the character buffer, can be overwritten by the hostname when the overflow occurs, but for some reason the crash doesn’t occur until the buffer intrudes into the “red zone” at the boundary of the heap chunk. Therefore, when the crash happens and the router reboots, the memory dump indicates heap corruption.

It must be reiterated that control of the hostname is required to exploit this vulnerability. If SNMP is running on the device and the rw community string is known (this is often set to the default value “private”) then the hostname can be set as follows:

$ snmpset -Os -c private -v 1 10.0.0.1 system.sysName.0 s long_hostname

Vendor & Patch Information:

Cisco have released an update to resolve this issue; this can be downloaded from:

 

http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml 

Workaround:

Cisco have provided the following workaround to mitigate this vulnerability:

http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml

Tested/Affected Versions:

IRM identified this vulnerability in IOS version 12.3(22)

Credits:

Research & Advisory: Andy Davis

Disclaimer:

All information in this advisory is provided on an 'as is' basis in the hope that it will be useful. Information Risk Management Plc is not responsible for any risks or occurrences caused by the application of this information.