Unknown vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to CUPS to execute arbitrary commands.

This update of hplip fixes :

  - CVE-2004-0801: CVSS v2 Base Score: 7.5     (AV:N/AC:L/Au:N/C:P/I:P/A:P): This patch originally     affected foomatic-rip in CUPS but was found to be in     foomatic-rip-hplip too.

This update of hplip fixes :

  - This patch originally affected foomatic-rip in CUPS but     was found to be in foomatic-rip-hplip too.
    (CVE-2004-0801: CVSS v2 Base Score: 7.5     (AV:N/AC:L/Au:N/C:P/I:P/A:P))

  - The foomatic print filters of the hplip package     contained a remote code execution vulnerability. Remote     users, if allowed to access a print server such as CUPS,     could execute arbitrary commands as lp system user.
    (CVE-2011-2697: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P))

A Bug in cupsomatic/foomatic-filters that allowed remote printer users to execute arbitrary commands as the uid of the printer daemon has been fixed (CAN-2004-0801). While the same problem was fixed in earlier products, the fix got lost during package upgrade of foomatic-filters.

Sebastian Krahmer reported a bug in the cupsomatic and foomatic-rip print filters, used by the CUPS print spooler. An attacker who has printing access could send a carefully named file to the print server causing arbitrary commands to be executed as root. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0801 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200409-24 (Foomatic: Arbitrary command execution in foomatic-rip filter)

    There is a vulnerability in the foomatic-filters package. This     vulnerability is due to insufficient checking of command-line parameters     and environment variables in the foomatic-rip filter.
  Impact :

    This vulnerability may allow both local and remote attackers to execute     arbitrary commands on the print server with the permissions of the spooler     (oftentimes the 'lp' user).
  Workaround :

    There is no known workaround at this time.

The foomatic-rip filter, which is part of foomatic-filters package, contains a vulnerability that allows anyone with access to CUPS, local or remote, to execute arbitrary commands on the server. The updated packages provide a fixed foomatic-rip filter that prevents this kind of abuse.

The remote host is missing the patch for the advisory SUSE-SA:2004:031 (cups).


The Common Unix Printing System (CUPS) enables local and remote users to obtain printing functionallity via the Internet Printing Protocol (IPP).
Alvaro Martinez Echevarria has found a remote Denial of Service condition within CUPS which allows remote users to make the cups server unresponsive.
Additionally the SUSE Security Team has discovered a flaw in the foomatic-rip print filter which is commonly installed along with cups.
It allows remote attackers, which are listed in the printing ACLs, to execute arbitrary commands as the printing user 'lp'.

ID	Name	Product	Family	Severity
75861	openSUSE Security Update : hplip (openSUSE-SU-2011:0950-1)	Nessus	SuSE Local Security Checks	high
75526	openSUSE Security Update : hplip (openSUSE-SU-2011:0950-1)	Nessus	SuSE Local Security Checks	high
55981	SuSE 11.1 Security Update : hplip (SAT Patch Number 4989)	Nessus	SuSE Local Security Checks	high
27222	openSUSE 10 Security Update : foomatic-filters (foomatic-filters-1436)	Nessus	SuSE Local Security Checks	high
14789	Fedora Core 2 : foomatic-3.0.1-3.1 (2004-303)	Nessus	Fedora Local Security Checks	high
14779	GLSA-200409-24 : Foomatic: Arbitrary command execution in foomatic-rip filter	Nessus	Gentoo Local Security Checks	high
14750	Mandrake Linux Security Advisory : printer-drivers (MDKSA-2004:094)	Nessus	Mandriva Local Security Checks	high
14730	SUSE-SA:2004:031: cups	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2004-0801

high

Tenable Plugins

high

high

high

high

high

high

high

high