Executive Summary

Title Cisco IOS LPD buffer overflow vulnerability
Name VU#230505 First vendor Publication 2007-10-13
Vendor VU-CERT Last vendor Modification 2007-10-15
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#230505

Cisco IOS LPD buffer overflow vulnerability


The Cisco IOS Line Printer Daemon contains a buffer overflow vulnerability. If successfully exploited, this vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition .

I. Description

The Cisco IOS includes support for the UNIX Line Printer Daemon (LPD) protocol. The LPD service listens on 515/tcp and is not enabled by default.

The IOS LPD service does not properly check the length of the hostname of the router. This error may result in a buffer overflow. See Cisco Security Response Document ID: 99109 for more information about this vulnerability.

From Information Risk Management Advisory 024:

    When the LPD daemon is configured in Cisco IOS it listens on the default LPD TCP port, 515. If connected to with a source TCP port of anything other than 515 the following error is displayed:
    $ telnet 515
    Connected to (
    Escape character is '^]'.
    hostname_of_the_router: /usr/lib/lpd: Malformed from address
    If the hostname is 99 characters or longer then the overflow occurs as the result of a call to the sprintf() function.

II. Impact

An attacker may be able to execute arbitrary code or create a denial-of-service condition .

III. Solution

Cisco has released an update to address this issue. See Cisco Security Response: Cisco IOS Line Printer Daemon (LPD) Protocol Stack Overflow Document ID: 99109 for more details.

The following workarounds may mitigate this vulnerability.

Restrict access
Using access control lists or firewall rules to limit access to port 515/tcp will prevent attackers from connecting to the LPD service.

Disable the LPD service
Disabling the LPD service will mitigate this vulnerability. See Cisco Security Response Document ID: 99109 for more information.

Disable unencrypted SNMP
The Simple Network Management Protocol (SNMP) service can be used to change settings or monitor device status. Some versions of Cisco IOS support SNMPv1, SNMPv2c, and SNMPv3. To use SNMP commands to change the hostname of an affected device, an attacker would need to know the SNMP read-write community string. SNMPv3 offers authentication and encryption features that may prevent an attacker from obtaining the read-write community string by sniffing Ethernet segments.

Disable SNMP
Disabling SNMP on affected devices may prevent this vulnerability from being exploited.

Systems Affected

VendorStatusDate Updated
Cisco Systems, Inc.Vulnerable13-Oct-2007




Information about this vulnerability was released by Information Risk Management.

This document was written by Ryan Giobbi.

Other Information

Date Public10/10/2007
Date First Published10/13/2007 08:44:24 AM
Date Last Updated10/15/2007
CERT Advisory 
CVE Name 
Document Revision11

Original Source

Url : http://www.kb.cert.org/vuls/id/230505

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

Os 1429

Open Source Vulnerability Database (OSVDB)

Id Description
37935 Cisco IOS Line Printer Daemon (LPD) Remote Overflow

Snort® IPS/IDS

Date Description
2014-01-10 oversized sysName set request
RuleID : 12712 - Revision : 5 - Type : PROTOCOL-SNMP

Nessus® Vulnerability Scanner

Date Description
2012-01-10 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sr-20071010-lpd.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2014-02-17 12:07:38
  • Multiple Updates