Integer underflow in the asn1_get_string function in the SNMP back end (backend/snmp.c) for CUPS 1.2 through 1.3.4 allows remote attackers to execute arbitrary code via a crafted SNMP response that triggers a stack-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code (CVE-2007-5849).

As well, the fix for CVE-2007-0720 in MDKSA-2007:086 caused another denial of service regression within SSL handling (CVE-2007-4045).

The updated packages have been patched to correct these issues.

Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. If a user were tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code.

Elias Pipping discovered that temporary files were not handled safely in certain situations when converting PDF to PS. A local attacker could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only.

Several local vulnerabilities have been discovered in the Common UNIX Printing System. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5849     Wei Wang discovered that an buffer overflow in the SNMP     backend may lead to the execution of arbitrary code.

  - CVE-2007-6358     Elias Pipping discovered that insecure handling of a     temporary file in the pdftops.pl script may lead to     local denial of service. This vulnerability is not     exploitable in the default configuration.

The remote host is affected by the vulnerability described in GLSA-200712-14 (CUPS: Multiple vulnerabilities)

    Wei Wang (McAfee AVERT Research) discovered an integer underflow in the     asn1_get_string() function of the SNMP backend, leading to a     stack-based buffer overflow when handling SNMP responses     (CVE-2007-5849). Elias Pipping (Gentoo) discovered that the alternate     pdftops filter creates temporary files with predictable file names when     reading from standard input (CVE-2007-6358). Furthermore, the     resolution of a Denial of Service vulnerability covered in GLSA     200703-28 introduced another Denial of Service vulnerability within SSL     handling (CVE-2007-4045).
  Impact :

    A remote attacker on the local network could exploit the first     vulnerability to execute arbitrary code with elevated privileges by     sending specially crafted SNMP messages as a response to an SNMP     broadcast request. A local attacker could exploit the second     vulnerability to overwrite arbitrary files with the privileges of the     user running the CUPS spooler (usually lp) by using symlink attacks. A     remote attacker could cause a Denial of Service condition via the third     vulnerability when SSL is enabled in CUPS.
  Workaround :

    To disable SNMP support in CUPS, you have have to manually delete the     file '/usr/libexec/cups/backend/snmp'. Please note that the file is     reinstalled if you merge CUPS again later. To disable the pdftops     filter, delete all lines referencing 'pdftops' in CUPS' 'mime.convs'     configuration file. To work around the third vulnerability, disable SSL     support via the corresponding USE flag.

According to its banner, the version of CUPS installed on the remote host contains a stack-based integer overflow in 'asn1_get_string' in 'backend/snmp.c'. Provided the SNMP backend is configured in CUPS (true by default in CUPS 1.2 but not 1.3), an attacker may be able to exploit this issue by using specially crafted SNMP responses with negative lengths to overflow a buffer and execute arbitrary code on the affected system.

The remote host is running the Common Unix Printing System (CUPS) daemon.  This version of CUPS is vulnerable to a remote buffer overflow.  The flaw is in the way that CUPS handles SNMP responses.  An attacker sending a malformed SNMP response would be able to execute arbitrary code on the remote system.  In order to exploit this flaw, the attacker would need for SNMP to be enabled on the CUPS server as well as the ability to intercept and respond to SNMP messages bound for valid hosts.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

ID	Name	Product	Family	Severity
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
37571	Mandriva Linux Security Advisory : cups (MDVSA-2008:036)	Nessus	Mandriva Local Security Checks	high
29919	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-563-1)	Nessus	Ubuntu Local Security Checks	high
29914	openSUSE 10 Security Update : cups (cups-4806)	Nessus	SuSE Local Security Checks	high
29803	Debian DSA-1437-1 : cupsys - several vulnerabilities	Nessus	Debian Local Security Checks	high
29734	GLSA-200712-14 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
29727	CUPS SNMP Back End (backend/snmp.c) asn1_get_string Function Crafted SNMP Response Remote Overflow	Nessus	Misc.	high
4320	CUPS < 1.3.5 Back End SNMP Response Remote Overflow	Nessus Network Monitor	Web Servers	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2007-5849

critical

Tenable Plugins

critical

high

high

high

high

high

high

medium

critical