CVE-2000-1220: Critical severity sgi irix vulnerability
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
lpr (lpd)from your environment.Uninstall the lpr package to remove the lpd daemon if printing services provided by it are not required on the system.
- Configuration
Stop and disable the lpd service (provided by the lpr package) using systemctl, service, or the platform's init tools to prevent local users from exploiting the daemon.
lpd (lpr package) service_enabled = disabled - Compensating control
Restrict local user access to the sendmail binary to prevent unprivileged users from invoking sendmail with arbitrary arguments (for example, tighten file permissions, remove execute permission for non-admin accounts, or enforce access via SELinux/AppArmor profiles).
- Operational
If a system may have been exposed, audit for signs of compromise, restore affected systems from known-good backups if necessary, and rotate credentials/keys that could have been exposed before re-enabling the service.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-1220?
CVE-2000-1220 is considered a high severity vulnerability due to the potential for local users to gain root privileges.
How do I fix CVE-2000-1220?
To fix CVE-2000-1220, it is recommended to update the lpr package to the latest version provided by your Linux distribution.
Which Linux versions are affected by CVE-2000-1220?
CVE-2000-1220 affects multiple versions of SGI IRIX and Red Hat Linux, specifically versions listed in the CVE description.
What kind of attack does CVE-2000-1220 enable?
CVE-2000-1220 enables local users to execute arbitrary commands as root by manipulating the line printer daemon.
Is CVE-2000-1220 a remote or local vulnerability?
CVE-2000-1220 is a local vulnerability, meaning it requires local access to the affected system to exploit.