####################################################################### Luigi Auriemma Application: WinCom LPD Total - Line Printer Daemon http://clientsoftware.com.au/lpd.html Versions: <= 3.0.2.623 Platforms: Windows Bugs: A] buffer-overflow in control filename B] remote administration bypassing C] integer memcpy crash in remote administration D] buffer-overflow in remote administration Exploitation: remote Date: 04 Feb 2008 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== WinCom LPD Total (wincomlpd) is a commercial line printer daemon for Windows. ####################################################################### ======= 2) Bugs ======= -------------------------------------- A] buffer-overflow in control filename -------------------------------------- wincomlpd is affected by a buffer-overflow vulnerability exploitable during the building of an error string caused by the impossibility of creating the file specified by the client. The queues of remote printers are not affected by the problem. ---------------------------------- B] remote administration bypassing ---------------------------------- The administration service which runs on port 13500 is used by the local and remote admins for managing the wincomlpd server. The problem here is very simple: the authentication method used by the program is practically unexistent. In short an attacker can manage the wincomlpd server without knowing the admin username and password but simply skipping the auth stage. This bug can be exploited in at least two ways: writing an alternative client (the protocol is enough simple so it's not a problem) or just modifying the admin client program (LPDAdmin.exe). ------------------------------------------------ C] integer memcpy crash in remote administration ------------------------------------------------ The 8 and 16 bit values used in the remote administration protocol for specifying respectively the length of the strings (like the printer's name to add) and the size of the data block are signed integers. That allows an attacker to crash the remote wincomlpd service simply using negative values like 0x80 or 0xff for the 8 bits numbers and 0x8000 or 0xffff for the data block and so on. This bug can be also used for exploiting the subsequent vulnerability. ------------------------------------------- D] buffer-overflow in remote administration ------------------------------------------- A buffer-overflow is located in the function which copies the data from the values explained before in a stack buffer. Naturally the criticality of the above two vulnerabilities is related to the possibility of bypassing the authentication explained in bug B. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/wincomalpd.zip ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org