The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

cups-filters was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2265: The remove_bad_chars function in     utils/cups-browsed.c in cups-filters before 1.0.66     allowed remote IPP printers to execute arbitrary     commands via consecutive shell metacharacters in the (1)     model or (2) PDL. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2014-2707     (bsc#921753).

  - CVE-2015-3279: Texttopdf integer overflow (incomplete     fix for CVE-2015-3258) (bsc#937018).

  - CVE-2015-3258: Texttopdf heap-based buffer overflow     (bsc#936281).

cups-filters was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-2265: Remote command execution in     remove_bad_chars() (bnc#921753).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cups-filters package fixes security vulnerability :

cups-browsed in cups-filters before 1.0.66 contained a bug in the remove_bad_chars\(\) function, where it failed to reliably filter out illegal characters if there were two or more subsequent illegal characters, allowing execution of arbitrary commands with the rights of the lp user, using forged print service announcements on DNS-SD servers (CVE-2015-2265).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2532-1 advisory.

    It was discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote     attacker could use this issue to possibly execute arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New upstream bug-fix release which fixes a security flaw in cups-browsed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This fixes a security flaw in cups-browsed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
84756	openSUSE Security Update : cups-filters (openSUSE-2015-492)	Nessus	SuSE Local Security Checks	Local	high
83722	SUSE SLED12 / SLES12 Security Update : cups-filters (SUSE-SU-2015:0805-1)	Nessus	SuSE Local Security Checks	Local	high
82633	Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:196)	Nessus	Mandriva Local Security Checks	Local	high
81880	Ubuntu 14.04 LTS : cups-filters vulnerability (USN-2532-1)	Nessus	Ubuntu Local Security Checks	Local	critical
81848	Fedora 21 : cups-filters-1.0.66-1.fc21 (2015-3036)	Nessus	Fedora Local Security Checks	Local	high
81846	Fedora 20 : cups-filters-1.0.53-6.fc20 (2015-3003)	Nessus	Fedora Local Security Checks	Local	high
81844	Fedora 22 : cups-filters-1.0.66-1.fc22 (2015-2949)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2015-2265

critical

Tenable Plugins

high

high

high

critical

high

high

high