CVE-2000-1221

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2000-01-08 · updated 2026-06-16

Description

The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by modifying the DNS for the attacking IP.

Affected products

Debian Linux: 2.1
RedHat Linux: 4.1, 4.2, 5.0, 5.2, 6.0, 6.1
Sgi Irix: 6.5, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5 (+18)

References

http://rhn.redhat.com/errata/RHSA-2000-002.html
http://www.atstake.com/research/advisories/2000/lpd_advisory.txt
http://www.debian.org/security/2000/20000109
http://www.kb.cert.org/vuls/id/30308
http://www.l0pht.com/advisories/lpd_advisory
http://www.securityfocus.com/bid/927
https://exchange.xforce.ibmcloud.com/vulnerabilities/3840
http://rhn.redhat.com/errata/RHSA-2000-002.html
http://www.atstake.com/research/advisories/2000/lpd_advisory.txt
http://www.debian.org/security/2000/20000109

Get alerted when CVE-2000-1221 or the next vulnerability affects your stack