The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption by tight loop) via a "..\.." URL in an HTTP request.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A bug was found in the way CUPS processes malformed HTTP requests. It is possible for a remote user capable of connecting to the CUPS daemon to issue a malformed HTTP GET request that causes CUPS to enter an infinite loop. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2874 to this issue.

Two small bugs have also been fixed in this update. A signal handling problem has been fixed that could occasionally cause the scheduler to stop when told to reload. A problem with tracking open file descriptors under certain specific circumstances has also been fixed.

All users of CUPS should upgrade to these erratum packages, which contain a patch to correct this issue.

A bug was found in the way CUPS processes malformed HTTP requests. It is possible for a remote user capable of connecting to the CUPS daemon to issue a malformed HTTP GET request which will cause CUPS to enter an infinite loop. This is CVE-2005-2874.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:772 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer     for UNIX(R) operating systems.

    A bug was found in the way CUPS processes malformed HTTP requests. It is     possible for a remote user capable of connecting to the CUPS daemon to     issue a malformed HTTP GET request that causes CUPS to enter an     infinite loop. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-2874 to this issue.

    Two small bugs have also been fixed in this update.  A signal handling     problem has been fixed that could occasionally cause the scheduler to stop     when told to reload.  A problem with tracking open file descriptors under     certain specific circumstances has also been fixed.

    All users of CUPS should upgrade to these erratum packages, which contain a     patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Kenshi Muto discovered that the CUPS server would enter an infinite loop when processing a URL containing /...

According to its banner, the version of CUPS installed on the remote host is between 1.0.4 and 1.1.22 inclusive. Such versions are prone to multiple vulnerabilities :

  - A remotely exploitable buffer overflow in the 'hpgltops'     filter that enable specially crafted HPGL files can     execute arbitrary commands as the CUPS 'lp' account.

  - A local user may be able to prevent anyone from changing     their password until a temporary copy of the new     password     file is cleaned up (lppasswd flaw).

  - A local user may be able to add arbitrary content to the     password file by closing the stderr file descriptor     while running lppasswd (lppasswd flaw).

  - A local attacker may be able to truncate the CUPS     password file, thereby denying service to valid clients     using digest authentication. (lppasswd flaw).

  - The application applies ACLs to incoming print jobs in a     case-sensitive fashion. Thus, an attacker can bypass     restrictions by changing the case in printer names when     submitting jobs. [Fixed in 1.1.21.]

ID	Name	Product	Family	Severity
23982	CentOS 4 : cups (CESA-2005:772)	Nessus	CentOS Local Security Checks	medium
19870	Fedora Core 3 : cups-1.1.22-0.rc1.8.7 (2005-908)	Nessus	Fedora Local Security Checks	medium
19834	RHEL 4 : cups (RHSA-2005:772)	Nessus	Red Hat Local Security Checks	high
19045	FreeBSD : cups-base -- CUPS server remote DoS vulnerability (990cf07e-6988-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
16141	CUPS < 1.1.23 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2005-2874

high

Tenable Plugins

medium

medium

high

medium

high