CVE-1999-0032: Buffer Overflow
Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
lprfrom your environment.If lpr is not required, uninstall or disable the lpr printing client on affected hosts to eliminate the vulnerable binary and prevent local exploitation via the -C option.
- Compensating control
Restrict execution of the lpr binary to trusted administrative users (for example, remove execute permission for non‑privileged users or enforce access via MAC such as AppArmor/SELinux) to mitigate local users exploiting the -C option.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0032?
CVE-1999-0032 is rated as a high severity vulnerability due to its potential for local users to execute arbitrary code as root.
How do I fix CVE-1999-0032?
To fix CVE-1999-0032, update the affected lpr software to a version that has patched the buffer overflow vulnerability.
Which systems are affected by CVE-1999-0032?
CVE-1999-0032 affects various BSD-based systems, including specific versions of SGI IRIX, SunOS, and FreeBSD.
Can CVE-1999-0032 be exploited remotely?
CVE-1999-0032 cannot be exploited remotely as it requires local access to execute the vulnerable command.
Who can be affected by CVE-1999-0032?
Local users on systems with the vulnerable lpr command can be affected by CVE-1999-0032.