Users login

Create an account »


Users login

Home » Security Advisories» FreeBSD » Buffer overflow in lpd

Buffer overflow in lpd

The lpd program runs as root. A remote attacker can exploit a buffer overflow to obtain root privs.

  • Vendor: FreeBSD
  • Vendor ID: SA-97:02
  • Date: March 26, 1997


FreeBSD-SA-97:02 Security Advisory
FreeBSD, Inc.

Topic: Buffer overflow in lpd

Category: core
Module: lpd
Announced: 1997-03-26
Affects: FreeBSD 2.1.7 and earlier and FreeBSD 2.2 snapshots
before 1997/02/25 suffer from this problem.
Corrected: FreeBSD-current as of 1997/02/25
FreeBSD 2.2 as of 1997/02/25
FreeBSD 2.1.x as of 1997/02/25
FreeBSD only: yes



I. Background

The lpd program is used to print local and remote print jobs. It
is standard software in the FreeBSD operating system.

II. Problem Description

The lpd program runs as root. A remote attacker can exploit a
buffer overflow to obtain root privs.

III. Impact

Remote users can gain root privs.

IV. Workaround

The only workaround is to disable lpd, which will have the effect
of removing the printing functionality from the system. Since
the buffer overflow happens before the connection is authenticated,
using lpd's authentication methods will not affect the system

V. Solution

Apply the following patch, rebuild and install libc:

(This patch can also be found on

Index: rcmd.c
RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/net/rcmd.c,v
retrieving revision
retrieving revision
diff -u -r1.3.4.4 -r1.3.4.5
--- rcmd.c 1997/02/09 06:57:54
+++ rcmd.c 1997/02/26 06:14:11
@@ -377,7 +377,8 @@
if ((hp = gethostbyaddr((char *)&raddr, sizeof(u_long),
return (-1);
- strcpy(hname, hp->h_name);
+ strncpy(hname, hp->h_name, sizeof(hname));
+ hname[sizeof(hname) - 1] = '\0';

while (fgets(buf, sizeof(buf), hostf)) {
p = buf;

VI. Thanks

This problem was brought to light by Oliver Friedrichs

FreeBSD, Inc.

Web Site:
Confidential contacts: [email protected]
PGP Key:
Security notifications: [email protected]
Security public discussion: [email protected]

Notice: Any patches in this document may not apply cleanly due to
modifications caused by digital signature or mailer software.
Please reference the URL listed at the top of this document
for original copies of all patches if necessary.

Version: 2.6.2


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »