CUPS 1.1.20 and earlier records authentication information for a device URI in the error_log file, which allows local users to obtain user names and passwords.

Certain methods of authenticated remote printing in CUPS can disclose user names and passwords in the log files.

A workaround for this problem is to set more strict access permissions on the CUPS logfiles.

An information leak has been detected in CUPS, the Common UNIX Printing System, which may lead to the disclosure of sensitive information, such as user names and passwords which are written into log files.

The used patch only eliminates the authentication information in the device URI which is logged in the error_log file. It does not eliminate the URI from the environment and process table, which is why the CUPS developers recommend that system administrators do not code authentication information in device URIs in the first place.

Updated cups packages that fix denial of service issues, a security information leak, as well as other various bugs are now available.

The Common UNIX Printing System (CUPS) is a print spooler.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect xpdf. CUPS contains a copy of the xpdf code used for parsing PDF files and is therefore affected by these bugs. An attacker who has the ability to send a malicious PDF file to a printer could cause CUPS to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0888 to this issue.

When set up to print to a shared printer via Samba, CUPS would authenticate with that shared printer using a username and password.
By default, the username and password used to connect to the Samba share is written into the error log file. A local user who is able to read the error log file could collect these usernames and passwords.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0923 to this issue.

These updated packages also include a fix that prevents some CUPS configuration files from being accidentally replaced.

All users of CUPS should upgrade to these updated packages, which resolve these issues.

Chris Evans discovered numerous vulnerabilities in the xpdf package, which also effect software using embedded xpdf code :

Multiple integer overflow issues affecting xpdf-2.0 and xpdf-3.0. Also programs like cups which have embedded versions of xpdf. These can result in writing an arbitrary byte to an attacker controlled location which probably could lead to arbitrary code execution. (CVE-2004-0888)

Also, when CUPS debugging is enabled, device URIs containing username and password end up in error_log. This information is also visible via 'ps'. (CVE-2004-0923)

The updated packages are patched to protect against these vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-200410-06 (CUPS: Leakage of sensitive information)

    When printing to a SMB-shared printer requiring authentication, CUPS leaks     the user name and password to a logfile.
  Impact :

    A local user could gain knowledge of sensitive authentication data.
  Workaround :

    There is no known workaround at this time.

This update fixes an information leakage problem when printing to SMB shares requiring authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0923 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing Security Update 2004-09-30.  This security update contains a number of fixes for the following programs :

  - AFP Server
  - CUPS
  - NetInfoManager
  - postfix
  - QuickTime
  - ServerAdmin

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

ID	Name	Product	Family	Severity
36362	FreeBSD : CUPS -- local information disclosure (30cea6be-1d0c-11d9-814e-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
15664	Debian DSA-566-1 : cupsys - unsanitised input	Nessus	Debian Local Security Checks	low
15630	RHEL 3 : cups (RHSA-2004:543)	Nessus	Red Hat Local Security Checks	critical
15551	Mandrake Linux Security Advisory : cups (MDKSA-2004:116)	Nessus	Mandriva Local Security Checks	critical
15444	GLSA-200410-06 : CUPS: Leakage of sensitive information	Nessus	Gentoo Local Security Checks	low
15422	Fedora Core 2 : cups-1.1.20-11.4 (2004-331)	Nessus	Fedora Local Security Checks	low
15420	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-30)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2004-0923

medium

Tenable Plugins

low

low

critical

critical

low

low

high