PT-2001-1062 · Red Hat+1 · Red Hat+1

Published 2001-10-18 · Updated 2017-10-10 · CVE-2001-0787

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LPRng versions 3.7.4 through 3.8.9 Red Hat Linux versions 7.0 through 7.1

Description The issue affects the LPRng package in Red Hat Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. A local user could elevate privileges due to the failure of LPRng to properly drop memberships in supplemental groups when lowering privileges.

Recommendations For LPRng versions 3.7.4 through 3.8.9, consider restricting access to the LPRng service until a patch is available. For Red Hat Linux versions 7.0 and 7.1, apply configuration changes to properly handle supplemental group memberships when lowering privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-08158

BDU:2015-08159

CVE-2001-0787

Affected Products

Lprng

Red Hat

References · 9

• 🔥 https://exploit-db.com/exploits/20923 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0787 · Security Note
• http://redhat.com/support/errata/RHSA-2001-077.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08158 · Security Note
• https://bdu.fstec.ru/vul/2015-08159 · Security Note
• http://securityfocus.com/bid/2865 · Note
• https://rhn.redhat.com/errata/RHSA-2003-142.html · Note
• http://ciac.org/ciac/bulletins/l-096.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6703 · Note