lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times.
| Software | From | Fixed in |
|---|---|---|
| sgi / irix | - | 5.2.x |
| bsd / bsd | 4.3 | 4.3.x |
| apple / a_ux | 2.0.1 | 2.0.1.x |
| sun / sunos | - | 4.1.1.x |