The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via a "partially-negotiated" SSL connection, which prevents other requests from being accepted.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2007:0123 :

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A bug was found in the way CUPS handled SSL negotiation. A remote user capable of connecting to the CUPS daemon could cause a denial of service to other CUPS users. (CVE-2007-0720)

All users of CUPS should upgrade to these updated packages, which contain a backported patch introducing a timeout, which prevents connections being kept open for an arbitrarily long time.

The previous cups update (CVE-2007-0720) was incomplete and could lead to cupsd crashing.

By keeping a partially negotiated SSL connection open an attacker could prevent the cups server from accepting other requests.
(CVE-2007-0720)

This update fixes several PDF handling security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a remote code execution vulnerability in the IPP handling part of the CUPS scheduler, as well as several PDF handling security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

By keeping a partially negotiated SSL connection open an attacker could prevent the cups server from accepting other requests (CVE-2007-0720).

Secunia reports :

CUPS is not using multiple workers to handle connections. This can be exploited to stop CUPS from accepting new connections by starting but never completing an SSL negotiation.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A bug was found in the way CUPS handled SSL negotiation. A remote user capable of connecting to the CUPS daemon could cause a denial of service to other CUPS users. (CVE-2007-0720)

All users of CUPS should upgrade to these updated packages, which contain a backported patch introducing a timeout, which prevents connections being kept open for an arbitrarily long time.

A flaw was discovered in how CUPS handled SSL negotiation that could allow a remote attacker capable of connecting to the CUPS daemon to cause a DoS to other CUPS users.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200703-28 (CUPS: Denial of Service)

    CUPS does not properly handle partially-negotiated SSL connections.
    Upon receiving a partially-negotiated SSL connection, CUPS no longer     accepts further incoming connections, as the initial connection never     times out.
  Impact :

    An attacker could partially negotiate an SSL connection with a CUPS     server, and cause future connections to that server to fail, resulting     in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The version of CUPS installed on the remote host suffers from a design flaw involving SSL auto-detection. By establishing a connection to a port on which the application attempts to auto-detect SSL and sending a single character, an unauthenticated, remote attacker can leverage this flaw to cause subsequent connections to hang until the first connection is closed.

Security fix update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

ID	Name	Product	Family	Severity
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
67462	Oracle Linux 3 / 4 / 5 : cups (ELSA-2007-0123)	Nessus	Oracle Linux Local Security Checks	medium
29411	SuSE 10 Security Update : cups (ZYPP Patch Number 3716)	Nessus	SuSE Local Security Checks	medium
29410	SuSE 10 Security Update : CUPS (ZYPP Patch Number 3137)	Nessus	SuSE Local Security Checks	medium
28162	Fedora 7 : cups-1.2.12-7.fc7 (2007-3100)	Nessus	Fedora Local Security Checks	high
27822	Fedora 8 : cups-1.3.4-2.fc8 (2007-2982)	Nessus	Fedora Local Security Checks	critical
27193	openSUSE 10 Security Update : cups (cups-3715)	Nessus	SuSE Local Security Checks	medium
27192	openSUSE 10 Security Update : cups (cups-3136)	Nessus	SuSE Local Security Checks	medium
25512	FreeBSD : cups -- Incomplete SSL Negotiation Denial of Service (39988ee8-1918-11dc-b6bd-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
25065	RHEL 3 / 4 / 5 : cups (RHSA-2007:0123)	Nessus	Red Hat Local Security Checks	medium
25064	Mandrake Linux Security Advisory : cups (MDKSA-2007:086)	Nessus	Mandriva Local Security Checks	medium
25041	CentOS 3 / 4 / 5 : cups (CESA-2007:0123)	Nessus	CentOS Local Security Checks	medium
24933	GLSA-200703-28 : CUPS: Denial of Service	Nessus	Gentoo Local Security Checks	medium
24901	CUPS Incomplete SSL Negotiation Remote DoS	Nessus	Misc.	medium
24820	Fedora Core 5 : cups-1.2.8-1.fc5 (2007-1219)	Nessus	Fedora Local Security Checks	medium
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2007-0720

high

Tenable Plugins

critical

medium

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

critical