cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."

cups-filters was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2265: The remove_bad_chars function in     utils/cups-browsed.c in cups-filters before 1.0.66     allowed remote IPP printers to execute arbitrary     commands via consecutive shell metacharacters in the (1)     model or (2) PDL. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2014-2707     (bsc#921753).

  - CVE-2015-3279: Texttopdf integer overflow (incomplete     fix for CVE-2015-3258) (bsc#937018).

  - CVE-2015-3258: Texttopdf heap-based buffer overflow     (bsc#936281).

Updated cups-filters packages fix security vulnerabilities :

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6473).

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6474, CVE-2013-6475).

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6476).

Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands on a server running the cups-browsed daemon (CVE-2014-2707).

In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337).

In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338).

The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336).

Note that only systems that have enabled the affected feature by using the CreateIPPPrinterQueues configuration directive in /etc/cups/cups-browsed.conf were affected by the CVE-2014-2707 / CVE-2014-4336 issue.

New upstream bug-fix release which fixes a security flaw in cups-browsed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This fixes a security flaw in cups-browsed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-16 (cups-filters: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cups-filters. Please       review the CVE identifiers referenced below for more details about the       vulnerabilities.
  Impact :

    A remote attacker(s) could possibly execute arbitrary code utilizing       multiple attack vectors, or a local attacker could gain escalated       privileges via a specially crafted shared library.
  Workaround :

    There is no known workaround at this time.

This update fixes two flaws and various bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote attacker could use this issue to possibly execute arbitrary commands. (CVE-2014-2707)

Johannes Meixner discovered that cups-browsed ignored invalid BrowseAllow directives. This could cause it to accept browse packets from all hosts, contrary to intended configuration.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update fixes remote command injection vulnerability in cups-browsed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84756	openSUSE Security Update : cups-filters (openSUSE-2015-492)	Nessus	SuSE Local Security Checks	high
82353	Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:100)	Nessus	Mandriva Local Security Checks	high
81848	Fedora 21 : cups-filters-1.0.66-1.fc21 (2015-3036)	Nessus	Fedora Local Security Checks	high
81846	Fedora 20 : cups-filters-1.0.53-6.fc20 (2015-3003)	Nessus	Fedora Local Security Checks	high
81844	Fedora 22 : cups-filters-1.0.66-1.fc22 (2015-2949)	Nessus	Fedora Local Security Checks	high
76084	GLSA-201406-16 : cups-filters: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
74382	Fedora 19 : cups-filters-1.0.53-2.fc19 (2014-5759)	Nessus	Fedora Local Security Checks	high
73941	Ubuntu 14.04 LTS : cups-filters vulnerability (USN-2210-1)	Nessus	Ubuntu Local Security Checks	critical
73877	Fedora 20 : cups-filters-1.0.53-1.fc20 (2014-5765)	Nessus	Fedora Local Security Checks	high
73539	Fedora 20 : cups-filters-1.0.41-6.fc20 (2014-4708)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2014-2707

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high