The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port.

If the CUPS server (cupsd) receives a zero-length UDP message, it will disable its print queue browser service.

New CUPS packages are available for Slackware 9.1, 10.0, and -current to fix a denial of service issue where a malformed packet can crash the CUPS server.

The target is running a CUPS server that supports browsing of network printers and that is vulnerable to a limited type of denial of service attack.  Specifically, the browsing feature can be disabled by sending an empty UDP datagram to the CUPS server.

The remote host is missing Security Update 2004-09-30.  This security update contains a number of fixes for the following programs :

  - AFP Server
  - CUPS
  - NetInfoManager
  - postfix
  - QuickTime
  - ServerAdmin

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

Alvaro Martinez Echevarria discovered a problem in CUPS, the Common UNIX Printing System. An attacker can easily disable browsing in CUPS by sending a specially crafted UDP datagram to port 631 where cupsd is running.

This update fixes a denial of service problem causing loss of browse services. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0558 to this issue.

In addition, this update fixes the cupsenable, cupsdisable and accept commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200409-25 (CUPS: Denial of service vulnerability)

    Alvaro Martinez Echevarria discovered a hole in the CUPS Internet Printing     Protocol (IPP) implementation that allows remote attackers to cause CUPS to     stop listening on the IPP port.
  Impact :

    A remote user with malicious intent can easily cause a denial of service to     the CUPS daemon by sending a specially crafted UDP datagram packet to the     IPP port.
  Workaround :

    There is no known workaround at this time.

Alvaro Martinez Echevarria discovered a vulnerability in the CUPS print server where an empty UDP datagram sent to port 631 (the default port that cupsd listens to) would disable browsing. This would prevent cupsd from seeing any remote printers or any future remote printer changes.

The updated packages are patched to protect against this vulnerability.

Updated cups packages that fix a denial of service vulnerability are now available.

The Common UNIX Printing System (CUPS) is a print spooler.

Alvaro Martinez Echevarria reported a bug in the CUPS Internet Printing Protocol (IPP) implementation in versions of CUPS prior to 1.1.21. An attacker could send a carefully crafted UDP packet to the IPP port which could cause CUPS to stop listening to the port and result in a denial of service. In order to exploit this bug, an attacker would need to have the ability to send a UDP packet to the IPP port (by default 631). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0558 to this issue.

All users of cups should upgrade to these updated packages, which contain a backported patch as well as a fix for a non-exploitable off-by-one bug.

The remote host is missing the patch for the advisory SUSE-SA:2004:031 (cups).


The Common Unix Printing System (CUPS) enables local and remote users to obtain printing functionallity via the Internet Printing Protocol (IPP).
Alvaro Martinez Echevarria has found a remote Denial of Service condition within CUPS which allows remote users to make the cups server unresponsive.
Additionally the SUSE Security Team has discovered a flaw in the foomatic-rip print filter which is commonly installed along with cups.
It allows remote attackers, which are listed in the printing ACLs, to execute arbitrary commands as the printing user 'lp'.

ID	Name	Product	Family	Severity
37713	FreeBSD : cups -- print queue browser denial-of-service (05dcf751-0733-11d9-b45d-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	medium
18752	Slackware 10.0 / 9.1 / current : CUPS DoS (SSA:2004-266-01)	Nessus	Slackware Local Security Checks	medium
15900	CUPS Internet Printing Protocol (IPP) Implementation Empty UDP Datagram Remote DoS	Nessus	Misc.	medium
15420	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-30)	Nessus	MacOS X Local Security Checks	high
15382	Debian DSA-545-1 : cupsys - denial of service	Nessus	Debian Local Security Checks	medium
14839	Fedora Core 2 : cups-1.1.20-11.3 (2004-275)	Nessus	Fedora Local Security Checks	medium
14780	GLSA-200409-25 : CUPS: Denial of service vulnerability	Nessus	Gentoo Local Security Checks	medium
14753	Mandrake Linux Security Advisory : cups (MDKSA-2004:097)	Nessus	Mandriva Local Security Checks	medium
14737	RHEL 3 : cups (RHSA-2004:449)	Nessus	Red Hat Local Security Checks	medium
14730	SUSE-SA:2004:031: cups	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2004-0558

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

high