Multiple vulnerabilities in WinCom LPD Total 3.0.2.623
#######################################################################
Luigi Auriemma
Application: WinCom LPD Total - Line Printer Daemon
http://clientsoftware.com.au/lpd.html
Versions: <= 3.0.2.623
Platforms: Windows
Bugs: A] buffer-overflow in control filename
B] remote administration bypassing
C] integer memcpy crash in remote administration
D] buffer-overflow in remote administration
Exploitation: remote
Date: 04 Feb 2008
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
WinCom LPD Total (wincomlpd) is a commercial line printer daemon for
Windows.
#######################################################################
=======
2) Bugs
=======
--------------------------------------
A] buffer-overflow in control filename
--------------------------------------
wincomlpd is affected by a buffer-overflow vulnerability exploitable
during the building of an error string caused by the impossibility of
creating the file specified by the client.
The queues of remote printers are not affected by the problem.
----------------------------------
B] remote administration bypassing
----------------------------------
The administration service which runs on port 13500 is used by the
local and remote admins for managing the wincomlpd server.
The problem here is very simple: the authentication method used by
the program is practically unexistent.
In short an attacker can manage the wincomlpd server without knowing
the admin username and password but simply skipping the auth stage.
This bug can be exploited in at least two ways: writing an alternative
client (the protocol is enough simple so it's not a problem) or just
modifying the admin client program (LPDAdmin.exe).
------------------------------------------------
C] integer memcpy crash in remote administration
------------------------------------------------
The 8 and 16 bit values used in the remote administration protocol for
specifying respectively the length of the strings (like the printer's
name to add) and the size of the data block are signed integers.
That allows an attacker to crash the remote wincomlpd service simply
using negative values like 0x80 or 0xff for the 8 bits numbers and
0x8000 or 0xffff for the data block and so on.
This bug can be also used for exploiting the subsequent vulnerability.
-------------------------------------------
D] buffer-overflow in remote administration
-------------------------------------------
A buffer-overflow is located in the function which copies the data from
the values explained before in a stack buffer.
Naturally the criticality of the above two vulnerabilities is related
to the possibility of bypassing the authentication explained in bug B.
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/wincomalpd.zip
#######################################################################
======
4) Fix
======
No fix
#######################################################################
---
Luigi Auriemma
http://aluigi.org