pdftops.pl before 1.20 in alternate pdftops filter allows local users to overwrite arbitrary files via a symlink attack on the pdfin.[PID].tmp temporary file, which is created when pdftops reads a PDF file from stdin, such as when pdftops is invoked by CUPS.

Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. If a user were tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code.

Elias Pipping discovered that temporary files were not handled safely in certain situations when converting PDF to PS. A local attacker could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local vulnerabilities have been discovered in the Common UNIX Printing System. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5849     Wei Wang discovered that an buffer overflow in the SNMP     backend may lead to the execution of arbitrary code.

  - CVE-2007-6358     Elias Pipping discovered that insecure handling of a     temporary file in the pdftops.pl script may lead to     local denial of service. This vulnerability is not     exploitable in the default configuration.

The remote host is affected by the vulnerability described in GLSA-200712-14 (CUPS: Multiple vulnerabilities)

    Wei Wang (McAfee AVERT Research) discovered an integer underflow in the     asn1_get_string() function of the SNMP backend, leading to a     stack-based buffer overflow when handling SNMP responses     (CVE-2007-5849). Elias Pipping (Gentoo) discovered that the alternate     pdftops filter creates temporary files with predictable file names when     reading from standard input (CVE-2007-6358). Furthermore, the     resolution of a Denial of Service vulnerability covered in GLSA     200703-28 introduced another Denial of Service vulnerability within SSL     handling (CVE-2007-4045).
  Impact :

    A remote attacker on the local network could exploit the first     vulnerability to execute arbitrary code with elevated privileges by     sending specially crafted SNMP messages as a response to an SNMP     broadcast request. A local attacker could exploit the second     vulnerability to overwrite arbitrary files with the privileges of the     user running the CUPS spooler (usually lp) by using symlink attacks. A     remote attacker could cause a Denial of Service condition via the third     vulnerability when SSL is enabled in CUPS.
  Workaround :

    To disable SNMP support in CUPS, you have have to manually delete the     file '/usr/libexec/cups/backend/snmp'. Please note that the file is     reinstalled if you merge CUPS again later. To disable the pdftops     filter, delete all lines referencing 'pdftops' in CUPS' 'mime.convs'     configuration file. To work around the third vulnerability, disable SSL     support via the corresponding USE flag.

ID	Name	Product	Family	Severity
29919	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-563-1)	Nessus	Ubuntu Local Security Checks	high
29803	Debian DSA-1437-1 : cupsys - several vulnerabilities	Nessus	Debian Local Security Checks	high
29734	GLSA-200712-14 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-6358

medium

Tenable Plugins

high

high

high