CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

When processing a request, the CUPS scheduler would use case-sensitive matching on the queue name to decide which authorization policy should be used. However, queue names are not case-sensitive. An unauthorized user could print to a password-protected queue without needing a password. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2154 to this issue.

Please note that the version of CUPS included in Red Hat Enterprise Linux 4 is not vulnerable to this issue.

All users of CUPS should upgrade to these erratum packages which contain a backported patch to correct this issue.

A flaw was detected in the printer access control list checking in the CUPS server. Printer names were compared in a case sensitive manner;
by modifying the capitalization of printer names, a remote attacker could circumvent ACLs and print to printers he should not have access to.

The Ubuntu 5.04 version of cupsys is not vulnerable against this.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in CUPS would treat a Location directive in cupsd.conf as case-sensitive, allowing attackers to bypass intended ACLs via a printer name containing uppercase or lowecase letters that are different from that which was specified in the Location directive.
This issue only affects versions of CUPS prior to 1.1.21rc1.

The updated packages have been patched to correct this problem.

ID	Name	Product	Family	Severity
21842	CentOS 3 : cups (CESA-2005:571)	Nessus	CentOS Local Security Checks	high
20596	Ubuntu 4.10 : cupsys vulnerability (USN-185-1)	Nessus	Ubuntu Local Security Checks	high
19920	Mandrake Linux Security Advisory : cups (MDKSA-2005:165)	Nessus	Mandriva Local Security Checks	high
19213	RHEL 3 : cups (RHSA-2005:571)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2004-2154

critical

Tenable Plugins

high

high

high

high