CVE-2001-1583: Solaris lpd control file command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command execution with complete impact and high EPSS, though the affected Solaris 8 and earlier platform is legacy.

What it is

The in.lpd daemon in Solaris 8 and earlier fails to properly handle a crafted print job control file, allowing command injection when lpd invokes a mail program. A remote attacker can send a malicious job request to the print service and execute arbitrary commands on the host. The record notes this may be the same issue as CVE-2000-1220.

Impact

An unauthenticated remote attacker gains arbitrary command execution, typically with the privileges of the lpd daemon, which can lead to full host compromise. The CVSS 2.0 vector rates complete confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via the LPD print service (TCP 515); the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The flaw is triggered by a job request containing a crafted control file.

Exploitation

Not listed in CISA KEV, but EPSS is 0.834 (99.7th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists. A Metasploit module reference is present but the link is broken.

What to do

• Apply the Solaris patch for the in.lpd control file handling flaw; consult Oracle/Sun advisories since the record does not list patch IDs.
• Disable or stop the LPD print service on hosts that do not require network printing.
• Restrict TCP 515 access to trusted print clients with host-based firewalls or network ACLs.
• Run lpd with least privilege and monitor for unexpected child processes such as mail programs spawned by print jobs.

Detection

• Monitor lpd logs and process trees for unexpected mail or shell processes spawned by in.lpd.
• Alert on LPD job submissions containing shell metacharacters or unusual control file content.
• Audit network flows to TCP 515 from untrusted sources and flag anomalous print job volume.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.