pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name, which are not properly handled when searching for network printers.

This update fixes a typo from the previous update :

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

- Add system-config-printer-subprocess-no-shell.patch:
    avoid escaping issues when running commands. Fix     bnc#735322.

  - Add system-config-printer-no-openprinting.patch: this     disables the feature where PPD drivers can be downloaded     from OpenPrinting.org. See discussion in bnc#733542. As     a side-effect, this fixes CVE-2011-4405.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1196 advisory.

    [0.7.32.10-1.0.1.el5_7.1]
    - Add oracle-bug-reporting.patch

    [0.7.32.10-1:.1]
    - Applied patch to fix CVE-2011-2899 (bug #728348).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

system-config-printer is a print queue configuration tool with a graphical user interface.

It was found that system-config-printer did not properly sanitize NetBIOS and workgroup names when searching for network printers. A remote attacker could use this flaw to execute arbitrary code with the privileges of the user running system-config-printer. (CVE-2011-2899)

All users of system-config-printer are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-printer must be restarted for this update to take effect.

The following issues have been fixed :

  - system-config-printer used an unauthenticated connection     when downloading printer drivers from openprinting.org     (CVE-2011-4405). This update disables the printer driver     download feature.

  - system-config-printer did not properly quote shell meta     characters in SMB server or workgroup names when passing     them to the shell. (CVE-2011-2899)

Updated system-config-printer packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

system-config-printer is a print queue configuration tool with a graphical user interface.

It was found that system-config-printer did not properly sanitize NetBIOS and workgroup names when searching for network printers. A remote attacker could use this flaw to execute arbitrary code with the privileges of the user running system-config-printer. (CVE-2011-2899)

All users of system-config-printer are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-printer must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1196 advisory.

    system-config-printer is a print queue configuration tool with a graphical     user interface.

    It was found that system-config-printer did not properly sanitize NetBIOS     and workgroup names when searching for network printers. A remote attacker     could use this flaw to execute arbitrary code with the privileges of the     user running system-config-printer. (CVE-2011-2899)

    All users of system-config-printer are advised to upgrade to these updated     packages, which contain a backported patch to resolve this issue. Running     instances of system-config-printer must be restarted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
76002	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	Local	high
76001	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	Local	high
75718	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	Local	high
75717	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	Local	high
74537	openSUSE Security Update : system-config-printer (openSUSE-2011-89)	Nessus	SuSE Local Security Checks	Local	high
68332	Oracle Linux 5 : system-config-printer (ELSA-2011-1196)	Nessus	Oracle Linux Local Security Checks	Local	critical
61120	Scientific Linux Security Update : system-config-printer on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	medium
57555	SuSE 11.1 Security Update : system-config-printer (SAT Patch Number 5607)	Nessus	SuSE Local Security Checks	Local	high
55996	CentOS 4 / 5 : system-config-printer (CESA-2011:1196)	Nessus	CentOS Local Security Checks	Local	medium
55965	RHEL 4 / 5 : system-config-printer (RHSA-2011:1196)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2011-2899

critical

Tenable Plugins

high

high

high

high

high

critical

medium

high

medium

critical