Multiple vulnerabilities in WinCom LPD Total 3.0.2.623

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052378 漏洞类型
发布时间 2008-11-20 更新时间 2008-11-20
CVE编号 CVE-2008-5158
CVE-2008-5159
CVE-2008-5176
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2008110122
|漏洞详情
漏洞细节尚未披露
|漏洞EXP

#######################################################################

Luigi Auriemma

Application:  WinCom LPD Total - Line Printer Daemon
              http://clientsoftware.com.au/lpd.html
Versions:     <= 3.0.2.623
Platforms:    Windows
Bugs:         A] buffer-overflow in control filename
              B] remote administration bypassing
              C] integer memcpy crash in remote administration
              D] buffer-overflow in remote administration
Exploitation: remote
Date:         04 Feb 2008
Author:       Luigi Auriemma
              e-mail: aluigi (at) autistici (dot) org [email concealed]
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

WinCom LPD Total (wincomlpd) is a commercial line printer daemon for
Windows.

#######################################################################

=======
2) Bugs
=======

--------------------------------------
A] buffer-overflow in control filename
--------------------------------------

wincomlpd is affected by a buffer-overflow vulnerability exploitable
during the building of an error string caused by the impossibility of
creating the file specified by the client.

The queues of remote printers are not affected by the problem.

----------------------------------
B] remote administration bypassing
----------------------------------

The administration service which runs on port 13500 is used by the
local and remote admins for managing the wincomlpd server.

The problem here is very simple: the authentication method used by
the program is practically unexistent.
In short an attacker can manage the wincomlpd server without knowing
the admin username and password but simply skipping the auth stage.

This bug can be exploited in at least two ways: writing an alternative
client (the protocol is enough simple so it's not a problem) or just
modifying the admin client program (LPDAdmin.exe).

------------------------------------------------
C] integer memcpy crash in remote administration
------------------------------------------------

The 8 and 16 bit values used in the remote administration protocol for
specifying respectively the length of the strings (like the printer's
name to add) and the size of the data block are signed integers.

That allows an attacker to crash the remote wincomlpd service simply
using negative values like 0x80 or 0xff for the 8 bits numbers and
0x8000 or 0xffff for the data block and so on.

This bug can be also used for exploiting the subsequent vulnerability.

-------------------------------------------
D] buffer-overflow in remote administration
-------------------------------------------

A buffer-overflow is located in the function which copies the data from
the values explained before in a stack buffer.

Naturally the criticality of the above two vulnerabilities is related
to the possibility of bypassing the authentication explained in bug B.

#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/wincomalpd.zip

#######################################################################

======
4) Fix
======

No fix

#######################################################################

--- 
Luigi Auriemma
http://aluigi.org