Detections
Analytics

CUPS < 1.4.7 'gif_read_lzw' Buffer Overflow

medium Nessus Plugin ID 56007

Language:

Synopsis

The remote print service is affected by a buffer overflow vulnerability.

Description

According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.7.

There is a boundary error in the function 'gif_read_lzw' in the file 'filter/image-gif.c' that can allow an attacker to cause a heap-based buffer overflow via specially crafted gif images.

Solution

Upgrade to CUPS version 1.4.7 or later.

See Also

http://www.cups.org/articles.php?L628

https://github.com/apple/cups/issues/3867

Plugin Details

Severity: Medium

ID: 56007

File Name: cups_1_4_7.nasl

Version: 1.9

Type: remote

Family: Misc.

Published: 8/29/2011

Updated: 7/6/2018

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 3.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:apple:cups

Required KB Items: www/cups, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 6/21/2011

Vulnerability Publication Date: 6/21/2011

Reference Information

CVE: CVE-2011-2896

BID: 49148