CUPS < 1.4.3 Multiple Vulnerabilities

High Nessus Plugin ID 45554

Synopsis

The remote printer service is affected by multiple vulnerabilities.

Description

According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.3. Such versions are affected by several vulnerabilities :

- A pointer use-after-free vulnerability exists in the abstract file descriptor handling code in the 'cupsdDoSelect' function in scheduler/select.c. A remote attacker may be able to leverage this to hang or crash the cupsd daemon by disconnecting while receiving a listing with a large number of print jobs. (STR #3200)

- The lppasswd utility, when its setuid bit is enabled, allowing a local user to elevaate privileges because it uses an environment variable to override CUPS' default directories and determine the location of a file with localized message strings. (STR #3482)

Solution

Upgrade to CUPS version 1.4.3 or later.

See Also

http://www.cups.org/str.php?L3200

http://www.cups.org/str.php?L3482

http://www.cups.org/articles.php?L594

Plugin Details

Severity: High

ID: 45554

File Name: cups_1_4_3.nasl

Version: 1.13

Type: remote

Family: Misc.

Published: 2010/04/16

Updated: 2018/07/06

Dependencies: 10107, 29727

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:apple:cups

Required KB Items: www/cups, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/03/30

Vulnerability Publication Date: 2010/03/03

Exploitable With

Core Impact

Reference Information

CVE: CVE-2009-3553, CVE-2010-0393

BID: 37048, 38524

CWE: 264, 399