CVE-2001-1002

Vulnerability

The dvips print filter in Red Hat Linux 7.0 and earlier runs without -R (secure) mode when executed by lpd, per the default configuration [1]. This allows a DVI file containing embedded system commands (e.g., via \special sequences) to be processed, potentially leading to command execution on the print server.

Exploitation

An attacker needs network access to the print service (lpd) and the ability to submit a crafted DVI file for printing. No authentication is required if the print server is exposed. The DVI file includes malicious \special directives that are passed to the shell by dvips.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the dvips process, typically lp or root, depending on the configuration. This leads to full compromise of the print server and potential lateral movement.

Mitigation

Red Hat issued an advisory (RHSA-2001:102) that provides updated packages running dvips in secure mode by default [1]. Administrators should upgrade to the fixed version. If upgrading is not immediate, ensure that dvips is invoked with the -R flag in the print filter configuration.