CVE-2000-1221: Critical severity SGI IRIX vulnerability
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by modifying the DNS for the attacking IP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
lpr/lpdfrom your environment.Uninstall the lpr package or disable the lpd service entirely on systems where printing is not required.
- Configuration
Disable the authentication that compares the client's reverse-resolved hostname to the server gethostname; reconfigure lpd to avoid relying on DNS-based hostname comparisons and use a non-DNS-based authentication method where available.
lpd (lpr package) hostname-based authentication = disabled - Compensating control
Restrict network access to the lpd service to trusted hosts/networks using firewall rules or ACLs, and harden DNS resolution used for authentication to prevent attacker-controlled reverse DNS entries from being trusted (e.g., use authenticated DNS or otherwise ensure DNS integrity).
Event History
Frequently Asked Questions
What is the severity of CVE-2000-1221?
CVE-2000-1221 has a moderate severity level due to its ability to bypass access controls.
How do I fix CVE-2000-1221?
To fix CVE-2000-1221, upgrade to the latest version of the lpr package that addresses this vulnerability.
Which systems are affected by CVE-2000-1221?
CVE-2000-1221 affects multiple versions of the SGI IRIX and Red Hat Linux operating systems.
What type of attack does CVE-2000-1221 enable?
CVE-2000-1221 enables remote attackers to bypass intended access controls on the line printer daemon.
Is CVE-2000-1221 still a concern today?
While CVE-2000-1221 is an older vulnerability, it remains a concern if affected systems are still in use and not patched.