Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

From Red Hat Security Advisory 2008:1028 :

Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

An integer overflow flaw, leading to a heap buffer overflow, was discovered in the Portable Network Graphics (PNG) decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious PNG file that could, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-5286)

CUPS users should upgrade to these updated packages, which contain a backported patch to correct this issue.

A NULL pointer dereference flaw was found in the way CUPS handled subscriptions for printing job completion notifications. A local user could use this flaw to crash the CUPS daemon by submitting a large number of printing jobs requiring mail notification on completion, leading to a denial of service. (CVE-2008-5183)

An integer overflow flaw, leading to a heap buffer overflow, was discovered in the Portable Network Graphics (PNG) decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious PNG file that could, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-5286)

Previous updates for the PNG and HPGL filters were incomplete and are corrected now. (CVE-2008-3641 / CVE-2008-5286)

Previous updates for the PNG and HPGL filters were incomplete and are corrected now. (CVE-2008-3641, CVE-2008-5286)

Previous updates for the PNG and HPGL filters were incomplete and are corrected now. Also cups used a guest user account for RSS subscriptions which made it eeasier for attackers to conduct CSRF attacks. (CVE-2008-3641, CVE-2008-5184, CVE-2008-5286)

It was discovered that CUPS didn't properly handle adding a large number of RSS subscriptions. A local user could exploit this and cause CUPS to crash, leading to a denial of service. This issue only applied to Ubuntu 7.10, 8.04 LTS and 8.10. (CVE-2008-5183)

It was discovered that CUPS did not authenticate users when adding and cancelling RSS subscriptions. An unprivileged local user could bypass intended restrictions and add a large number of RSS subscriptions.
This issue only applied to Ubuntu 7.10 and 8.04 LTS. (CVE-2008-5184)

It was discovered that the PNG filter in CUPS did not properly handle certain malformed images. If a user or automated system were tricked into opening a crafted PNG image file, a remote attacker could cause a denial of service or execute arbitrary code with user privileges. In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-5286)

It was discovered that the example pstopdf CUPS filter created log files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. (CVE-2008-5377).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities have been discovered and corrected in CUPS.

CUPS before 1.3.8 allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference (CVE-2008-5183).

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions (CVE-2008-5184).

CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow (CVE-2008-5286).

CUPS shipped with Mandriva Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file (CVE-2009-0032).

The updated packages have been patched to prevent this.

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10. Such versions are affected by several issues :

  - A potential integer overflow in the PNG image validation     code in '_cupsImageReadPNG()' could allow an attacker to     crash the affected service or possibly execute arbitrary     code. (STR #2974)

  - A heap-based integer overflow exists in     '_cupsImageReadTIFF()' due to a failure to properly     validate the image height of a specially crafted TIFF     file, which can be leveraged to execute arbitrary code.
    (STR #3031)

  - The web interface may be vulnerable to DNS rebinding     attacks due to a failure to validate the HTTP Host     header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops allows remote     attackers to execute arbitrary code via a PDF file with     crafted JBIG2 symbol dictionary segments.
    (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function     'ippReadIO()' could allow an anonymous remote attacker     to crash the application via a malicious IPP request     packet with two consecutives IPP_TAG_UNSUPPORTED tags.
    (CVE-2009-0949)

Previous updates for the PNG and HPGL filters were incomplete and are corrected now (CVE-2008-3641, CVE-2008-5286).

Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

An integer overflow flaw, leading to a heap buffer overflow, was discovered in the Portable Network Graphics (PNG) decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious PNG file that could, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-5286)

CUPS users should upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200812-11 (CUPS: Multiple vulnerabilities)

    Several buffer overflows were found in:
    The read_rle16 function in imagetops (CVE-2008-3639, found by     regenrecht, reported via ZDI)     The WriteProlog function in texttops (CVE-2008-3640, found by     regenrecht, reported via ZDI)     The Hewlett-Packard Graphics Language (HPGL) filter (CVE-2008-3641,     found by regenrecht, reported via iDefense)     The _cupsImageReadPNG function (CVE-2008-5286, reported by iljavs)   Impact :

    A remote attacker could send specially crafted input to a vulnerable     server, resulting in the remote execution of arbitrary code with the     privileges of the user running the server.
  Workaround :

    None this time.

An integer overflow has been discovered in the image validation code of cupsys, the Common UNIX Printing System. An attacker could trigger this bug by supplying a malicious graphic that could lead to the execution of arbitrary code.

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10.  Such versions are affected by multiple integer overflow vulnerabilities : 

  - A potential integer overflow in the PNG image validation code in '_cupsImageReadPNG()'. (STR #2974)

  - A heap-based integer overflow in '_cupsImageReadTIFF()'. (STR #3031)

  - The web interface may be vulnerable to DNS rebinding attacks due to a failure to validate the HTTP Host header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops. (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function 'ippReadIO()' could allow an attacker to crash the application.

CUPS reports :

The PNG image reading code did not validate the image size properly, leading to a potential buffer overflow (STR #2974)

ID	Name	Product	Family	Severity
67775	Oracle Linux 3 : cups (ELSA-2008-1028)	Nessus	Oracle Linux Local Security Checks	high
60503	Scientific Linux Security Update : cups on SL3.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41493	SuSE 10 Security Update : Cups (ZYPP Patch Number 5845)	Nessus	SuSE Local Security Checks	critical
41261	SuSE9 Security Update : Cups (YOU Patch Number 12317)	Nessus	SuSE Local Security Checks	critical
39943	openSUSE Security Update : cups (cups-356)	Nessus	SuSE Local Security Checks	critical
38132	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : cups, cupsys vulnerabilities (USN-707-1)	Nessus	Ubuntu Local Security Checks	critical
36414	Mandriva Linux Security Advisory : cups (MDVSA-2009:028)	Nessus	Mandriva Local Security Checks	critical
36183	CUPS < 1.3.10 Multiple Vulnerabilities	Nessus	Misc.	high
35368	openSUSE 10 Security Update : cups (cups-5838)	Nessus	SuSE Local Security Checks	critical
35182	RHEL 3 : cups (RHSA-2008:1028)	Nessus	Red Hat Local Security Checks	high
35173	CentOS 3 : cups (CESA-2008:1028)	Nessus	CentOS Local Security Checks	high
35086	GLSA-200812-11 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
35011	Debian DSA-1677-1 : cupsys - integer overflow	Nessus	Debian Local Security Checks	high
4771	CUPS < 1.3.10 Multiple Overflows	Nessus Network Monitor	Web Servers	high
34980	FreeBSD : cups -- potential buffer overflow in PNG reading code (87106b67-be13-11dd-a578-0030843d3802)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-5286

critical

Tenable Plugins

high

high

critical

critical

critical

critical

critical

high

critical

high

high

critical

high

high

high