CVE-2000-1220
SGI IRIX - Local Privilege Escalation via lpd sendmail Argument Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2000-1220. PoCs published by Vadim Kolontsov.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in the `lpr` command (CVE-2000-1220) by crafting a malicious input that overflows the buffer in the `card()` function, leading to arbitrary code execution. The PoC includes shellcode to spawn a `/bin/sh` shell and is designed for both Linux and BSD systems.
Description
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.
Exploits (1)
This exploit targets a buffer overflow vulnerability in the `lpr` command (CVE-2000-1220) by crafting a malicious input that overflows the buffer in the `card()` function, leading to arbitrary code execution. The PoC includes shellcode to spawn a `/bin/sh` shell and is designed for both Linux and BSD systems.