Updated CUPS packages that fix several security issues are now available.

The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems.

A buffer overflow was found in the CUPS pdftops filter, which uses code from the Xpdf package. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the 'lp' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1125 to this issue.

A buffer overflow was found in the ParseCommand function in the hpgltops program. An attacker who has the ability to send a malicious HPGL file to a printer could possibly execute arbitrary code as the 'lp' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1267 to this issue.

Red Hat believes that the Exec-Shield technology (enabled by default since Update 3) will block attempts to exploit these buffer overflow vulnerabilities on x86 architectures.

The lppasswd utility ignores write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS password file or prevent future uses of lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1268 and CVE-2004-1269 to these issues.

The lppasswd utility does not verify that the passwd.new file is different from STDERR, which could allow local users to control output to passwd.new via certain user input that triggers an error message.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1270 to this issue.

In addition to these security issues, two other problems not relating to security have been fixed :

Resuming a job with 'lp -H resume', which had previously been held with 'lp -H hold' could cause the scheduler to stop. This has been fixed in later versions of CUPS, and has been backported in these updated packages.

The cancel-cups(1) man page is a symbolic link to another man page.
The target of this link has been corrected.

All users of cups should upgrade to these updated packages, which resolve these issues.

According to its banner, the version of CUPS installed on the remote host is between 1.0.4 and 1.1.22 inclusive. Such versions are prone to multiple vulnerabilities :

  - A remotely exploitable buffer overflow in the 'hpgltops'     filter that enable specially crafted HPGL files can     execute arbitrary commands as the CUPS 'lp' account.

  - A local user may be able to prevent anyone from changing     their password until a temporary copy of the new     password     file is cleaned up (lppasswd flaw).

  - A local user may be able to add arbitrary content to the     password file by closing the stderr file descriptor     while running lppasswd (lppasswd flaw).

  - A local attacker may be able to truncate the CUPS     password file, thereby denying service to valid clients     using digest authentication. (lppasswd flaw).

  - The application applies ACLs to incoming print jobs in a     case-sensitive fashion. Thus, an attacker can bypass     restrictions by changing the case in printer names when     submitting jobs. [Fixed in 1.1.21.]

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:053 advisory.

  - security flaw (CVE-2004-1125, CVE-2004-1267, CVE-2004-1268, CVE-2004-1269, CVE-2004-1270, CVE-2005-0064,     CVE-2005-0206)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue :

First, lppasswd blithely ignores write errors in fputs(line,outfile) at lines 311 and 315 of lppasswd.c, and in fprintf(...) at line 346.
An attacker who fills up the disk at the right moment can arrange for /usr/local/etc/cups/passwd to be truncated. (CAN-2004-1268)

Second, if lppasswd bumps into a file-size resource limit while writing passwd.new, it leaves passwd.new in place, disabling all subsequent invocations of lppasswd. Any local user can thus disable lppasswd... (CAN-2004-1269)

Third, line 306 of lppasswd.c prints an error message to stderr but does not exit. This is not a problem on systems that ensure that file descriptors 0, 1, and 2 are open for setuid programs, but it is a problem on other systems; lppasswd does not check that passwd.new is different from stderr, so it ends up writing a user-controlled error message to passwd if the user closes file descriptor 2.
(CAN-2004-1270)

Note: The third issue, CVE-2004-1270, does not affect FreeBSD 4.6-RELEASE or later systems, as these systems ensure that the file descriptors 0, 1, and 2 are always open for set-user-ID and set-group-ID programs.

A buffer overflow was discovered in the ParseCommand function in the hpgltops utility. An attacker with the ability to send malicious HPGL files to a printer could possibly execute arbitrary code as the 'lp' user (CVE-2004-1267).

Vulnerabilities in the lppasswd utility were also discovered. The program ignores write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS passwd file or prevent future use of lppasswd (CVE-2004-1268 and CVE-2004-1269). As well, lppasswd does not verify that the passwd.new file is different from STDERR, which could allow a local user to control output to passwd.new via certain user input that could trigger an error message (CVE-2004-1270).

The updated packages have been patched to prevent these problems.

CAN-2004-1125 :

The recent USN-48-1 fixed a buffer overflow in xpdf. Since CUPS contains xpdf code to convert incoming PDF files to the PostScript format, this vulnerability applies to cups as well.

In this case it could even lead to privilege escalation: if an attacker submitted a malicious PDF file for printing, he could be able to execute arbitrary commands with the privileges of the CUPS server.

Please note that the Ubuntu version of CUPS runs as a minimally privileged user 'cupsys' by default, so there is no possibility of root privilege escalation. The privileges of the 'cupsys' user are confined to modifying printer configurations, altering print jobs, and controlling printers.

CAN-2004-1267 :

Ariel Berkman discovered a buffer overflow in the ParseCommand() function of the HPGL input driver. If an attacker printed a malicious HPGL file, they could exploit this to execute arbitrary commands with the privileges of the CUPS server.

CAN-2004-1268, CAN-2004-1269, CAN-2004-1270 :

Bartlomiej Sieka discovered three flaws in lppasswd. These allowed users to corrupt the new password file by filling up the disk, sending certain signals, or closing the standard output and/or error streams.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200412-25 (CUPS: Multiple vulnerabilities)

    CUPS makes use of vulnerable Xpdf code to handle PDF files     (CAN-2004-1125). Furthermore, Ariel Berkman discovered a buffer     overflow in the ParseCommand function in hpgl-input.c in the hpgltops     program (CAN-2004-1267). Finally, Bartlomiej Sieka discovered several     problems in the lppasswd program: it ignores some write errors     (CAN-2004-1268), it can leave the passwd.new file in place     (CAN-2004-1269) and it does not verify that passwd.new file is     different from STDERR (CAN-2004-1270).
  Impact :

    The Xpdf and hpgltops vulnerabilities may be exploited by a remote     attacker to execute arbitrary code by sending specific print jobs to a     CUPS spooler. The lppasswd vulnerabilities may be exploited by a local     attacker to write data to the CUPS password file or deny further     password modifications.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
16146	RHEL 3 : cups (RHSA-2005:013)	Nessus	Red Hat Local Security Checks	1/13/2005	1/14/2021	high
16141	CUPS < 1.1.23 Multiple Vulnerabilities	Nessus	Misc.	1/12/2005	7/6/2018	high
17174	RHEL 4 : CUPS (RHSA-2005:053)	Nessus	Red Hat Local Security Checks	2/22/2005	4/27/2024	high
18990	FreeBSD : cups-lpr -- lppasswd multiple vulnerabilities (7850a238-680a-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	7/13/2005	1/6/2021	medium
16184	Mandrake Linux Security Advisory : cups (MDKSA-2005:008)	Nessus	Mandriva Local Security Checks	1/18/2005	1/6/2021	medium
20668	Ubuntu 4.10 : cupsys vulnerabilities (USN-50-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	high
16067	GLSA-200412-25 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/28/2004	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

high

medium

medium

high

high