The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.

The remote NewStart CGSL host, running version MAIN 6.06, has cups packages installed that are affected by multiple vulnerabilities:

  - ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with     invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and     application crash) or possibly execute arbitrary code via a crafted IPP request. (CVE-2010-2941)

  - The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to     execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.
    (CVE-2008-3641)

  - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others,     allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as     demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka Infinite CPU spins.
    (CVE-2005-3625)

  - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others,     allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a     null dereference. (CVE-2005-3626)

  - Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor,     and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream     with (1) a large number of components value that is not checked by DCTStream::readBaselineSOF or     DCTStream::readProgressiveSOF, (2) a large Huffman table index value that is not checked by     DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by     DCTStream::readScanInfo. (CVE-2005-3627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:1023 :

Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash.
(CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045)

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2007:1022 :

Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash.
(CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045)

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Problem description :

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash.
(CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045)

Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code (CVE-2007-5849).

As well, the fix for CVE-2007-0720 in MDKSA-2007:086 caused another denial of service regression within SSL handling (CVE-2007-4045).

The updated packages have been patched to correct these issues.

Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash.
(CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045)

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash.
(CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045)

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200712-14 (CUPS: Multiple vulnerabilities)

    Wei Wang (McAfee AVERT Research) discovered an integer underflow in the     asn1_get_string() function of the SNMP backend, leading to a     stack-based buffer overflow when handling SNMP responses     (CVE-2007-5849). Elias Pipping (Gentoo) discovered that the alternate     pdftops filter creates temporary files with predictable file names when     reading from standard input (CVE-2007-6358). Furthermore, the     resolution of a Denial of Service vulnerability covered in GLSA     200703-28 introduced another Denial of Service vulnerability within SSL     handling (CVE-2007-4045).
  Impact :

    A remote attacker on the local network could exploit the first     vulnerability to execute arbitrary code with elevated privileges by     sending specially crafted SNMP messages as a response to an SNMP     broadcast request. A local attacker could exploit the second     vulnerability to overwrite arbitrary files with the privileges of the     user running the CUPS spooler (usually lp) by using symlink attacks. A     remote attacker could cause a Denial of Service condition via the third     vulnerability when SSL is enabled in CUPS.
  Workaround :

    To disable SNMP support in CUPS, you have have to manually delete the     file '/usr/libexec/cups/backend/snmp'. Please note that the file is     reinstalled if you merge CUPS again later. To disable the pdftops     filter, delete all lines referencing 'pdftops' in CUPS' 'mime.convs'     configuration file. To work around the third vulnerability, disable SSL     support via the corresponding USE flag.

This update fixes several PDF handling security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a remote code execution vulnerability in the IPP handling part of the CUPS scheduler, as well as several PDF handling security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266283	NewStart CGSL MAIN 6.06 : cups Multiple Vulnerabilities (NS-SA-2025-0218)	Nessus	NewStart CGSL Local Security Checks	critical
67600	Oracle Linux 3 : cups (ELSA-2007-1023)	Nessus	Oracle Linux Local Security Checks	critical
67599	Oracle Linux 4 : cups (ELSA-2007-1022)	Nessus	Oracle Linux Local Security Checks	critical
60286	Scientific Linux Security Update : cups on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
37571	Mandriva Linux Security Advisory : cups (MDVSA-2008:036)	Nessus	Mandriva Local Security Checks	high
37449	CentOS 3 : cups (CESA-2007:1023)	Nessus	CentOS Local Security Checks	critical
37428	CentOS 4 : cups (CESA-2007:1022)	Nessus	CentOS Local Security Checks	critical
36860	RHEL 4 : cups (RHSA-2007:1022)	Nessus	Red Hat Local Security Checks	critical
29734	GLSA-200712-14 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
28162	Fedora 7 : cups-1.2.12-7.fc7 (2007-3100)	Nessus	Fedora Local Security Checks	high
27836	RHEL 3 : cups (RHSA-2007:1023)	Nessus	Red Hat Local Security Checks	critical
27822	Fedora 8 : cups-1.3.4-2.fc8 (2007-2982)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2007-4045

high

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

high

high

critical

critical