Security fix for CVE-2017-18248

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities affecting the cups printing server were found which can lead to arbitrary IPP command execution and denial of service.

CVE-2017-18190

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

CVE-2017-18248

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.5-11+deb8u3.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-18248 It was found that by submitting a print job with an invalid username, the CUPS server can be crashed, when D-Bus support is enabled (which is the case for Debian).

For Debian 7 'Wheezy', these problems have been fixed in version 1.5.3-5+deb7u8.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2017-18248: Handle invalid characters properly in     printing jobs. This fixes a problem that was causing the     DBUS library to abort the calling process. (bsc#1061066     bsc#1087018)

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408)

The following other issue was fixed :

  - Fixed authorization check for clients (like samba)     connected through the local socket when Kerberos     authentication is enabled (bsc#1050082)

This update was imported from the SUSE:SLE-12:Update update project.

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The add_job function in scheduler/ipp.c in CUPS before     2.2.6, when D-Bus support is enabled, can be crashed by     remote attackers by sending print jobs with an invalid     username, related to a D-Bus     notification.(CVE-2017-18248)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-8696)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-8675)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The add_job function in scheduler/ipp.c in CUPS before     2.2.6, when D-Bus support is enabled, can be crashed by     remote attackers by sending print jobs with an invalid     username, related to a D-Bus     notification.(CVE-2017-18248)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2017-18248: Handle invalid characters properly in     printing jobs. This fixes a problem that was causing the     DBUS library to abort the calling process. (bsc#1061066     bsc#1087018)

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408) The following other issue     was fixed :

  - Fixed authorization check for clients (like samba)     connected through the local socket when Kerberos     authentication is enabled (bsc#1050082)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that CUPS incorrectly handled certain print jobs with invalid usernames. A remote attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2017-18248)

Dan Bastone discovered that the CUPS dnssd backend incorrectly handled certain environment variables. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-4180)

Eric Rafaloff and John Dunlap discovered that CUPS incorrectly handled certain include directives. A local attacker could possibly use this issue to read arbitrary files. (CVE-2018-4181)

Dan Bastone discovered that the CUPS AppArmor profile incorrectly confined the dnssd backend. A local attacker could possibly use this issue to escape confinement. (CVE-2018-6553).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The add_job function in scheduler/ipp.c in CUPS before     2.2.6, when D-Bus support is enabled, can be crashed by     remote attackers by sending print jobs with an invalid     username, related to a D-Bus     notification.(CVE-2017-18248)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The add_job function in scheduler/ipp.c in CUPS before     2.2.6, when D-Bus support is enabled, can be crashed by     remote attackers by sending print jobs with an invalid     username, related to a D-Bus     notification.(CVE-2017-18248)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-8696)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-8675)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
108921	Fedora 26 : 1:cups (2018-ec5f10e626)	Nessus	Fedora Local Security Checks	4/10/2018	1/6/2021	medium
108914	Fedora 27 : 1:cups (2018-99f551e4ff)	Nessus	Fedora Local Security Checks	4/10/2018	1/6/2021	medium
110909	Debian DLA-1412-1 : cups security update	Nessus	Debian Local Security Checks	7/5/2018	1/11/2021	high
110163	Debian DLA-1387-1 : cups security update	Nessus	Debian Local Security Checks	5/29/2018	1/11/2021	medium
111587	openSUSE Security Update : cups (openSUSE-2018-822)	Nessus	SuSE Local Security Checks	8/8/2018	1/19/2021	high
135623	EulerOS Virtualization 3.0.2.2 : cups (EulerOS-SA-2020-1461)	Nessus	Huawei Local Security Checks	4/16/2020	3/15/2024	high
132282	EulerOS 2.0 SP3 : cups (EulerOS-SA-2019-2565)	Nessus	Huawei Local Security Checks	12/19/2019	4/3/2024	medium
131576	EulerOS 2.0 SP2 : cups (EulerOS-SA-2019-2422)	Nessus	Huawei Local Security Checks	12/4/2019	4/8/2024	medium
111508	SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2018:2162-1)	Nessus	SuSE Local Security Checks	8/2/2018	1/13/2021	high
111041	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : CUPS vulnerabilities (USN-3713-1)	Nessus	Ubuntu Local Security Checks	7/12/2018	10/20/2023	high
134516	EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2020-1227)	Nessus	Huawei Local Security Checks	3/13/2020	3/22/2024	medium
131511	EulerOS Virtualization for ARM 64 3.0.3.0 : cups (EulerOS-SA-2019-2346)	Nessus	Huawei Local Security Checks	12/3/2019	4/8/2024	high
130844	EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-2135)	Nessus	Huawei Local Security Checks	11/12/2019	4/12/2024	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

high

high

medium

medium

high

high

medium

high

medium