Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0192 advisory.

    - Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117).
    - Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

SL5 Only: A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

SL 3 &amp; 4 Only: It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Scientific Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)

Red Hat would like to thank 'regenrecht' for reporting this issue.

This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

A heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047).

A validation error in the Hp-GL/2 filter was also discovered (CVE-2008-0053).

Finally, a vulnerability in how CUPS handled GIF files was found by Tomas Hoger of Red Hat, similar to previous issues corrected in PHP, gd, tk, netpbm, and SDL_image (CVE-2008-1373).

The updated packages have been patched to correct these issues.

Three security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation * A buffer overflow when processing HP-GL/2 files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation This update also fixes a problem with processing some JPEG files.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)

It was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0053)

It was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0882)

It was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200804-01 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in CUPS:
    regenrecht (VeriSign iDefense) discovered that the     cgiCompileSearch() function used in several CGI scripts in CUPS'     administration interface does not correctly calculate boundaries when     processing a user-provided regular expression, leading to a heap-based     buffer overflow (CVE-2008-0047).
    Helge Blischke reported a     double free() vulnerability in the process_browse_data() function when     adding or removing remote shared printers (CVE-2008-0882).
    Tomas Hoger (Red Hat) reported that the gif_read_lzw() function     uses the code_size value from GIF images without properly checking it,     leading to a buffer overflow (CVE-2008-1373).
    An unspecified     input validation error was discovered in the HP-GL/2 filter     (CVE-2008-0053).
  Impact :

    A local attacker could send specially crafted network packets or print     jobs and possibly execute arbitrary code with the privileges of the     user running CUPS (usually lp), or cause a Denial of Service. The     vulnerabilities are exploitable via the network when CUPS is sharing     printers remotely.
  Workaround :

    There is no known workaround at this time.

New cups packages are available for Slackware 12.0, and -current to fix security issues. The change from CUPS 1.2.x to CUPS 1.3.x was tested here, but if you're on a completely secured internal network these issues may be less of a risk than upgrading. If your IPP port is open to the internet, you'd be advised to upgrade as soon as possible (or firewall the port at the gateway if you're not in need of printer jobs coming in from the internet).

According to its banner, the version of CUPS installed on the remote host is affected by several issues :

  - A buffer overflow in 'cgiCompileSearch' that can lead to arbitrary code execution (STR #2729).
  - A GIF image filter overflow involving 'code_size' value from a user-supplied GIF image used in 'gif_read_lzw' (STR #2765).
  - A temporary file with Samba credentials may be left behind by cupsaddsmb if no Windows drivers were installed (STR #2779).

According to its banner, the version of CUPS installed on the remote host is affected by several issues :

  - A buffer overflow exists in 'cgiCompileSearch' that     could lead to arbitrary code execution (STR #2729).

  - A GIF image filter overflow exists involving 'code_size'     value from a user-supplied GIF image used in     'gif_read_lzw' (STR #2765).

  - A temporary file with Samba credentials may be left     behind by cupsaddsmb if no Windows drivers were     installed (STR #2779).

Several local/remote vulnerabilities have been discovered in cupsys, the Common Unix Printing System. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0047     Heap-based buffer overflow in CUPS, when printer sharing     is enabled, allows remote attackers to execute arbitrary     code via crafted search expressions.

  - CVE-2008-0882     Double free vulnerability in the process_browse_data     function in CUPS 1.3.5 allows remote attackers to cause     a denial of service (daemon crash) and possibly the     execution of arbitrary code via crafted packets to the     cupsd port (631/udp), related to an unspecified     manipulation of a remote printer.

This update of cups fixes a heap-overflow in cgiCompileSearch() that can be abused to execute arbitrary code remotely. (CVE-2008-0047) This bug can only be exploited if the web-interface (631/TCP) is enabled and the CGI scripts use the affected function.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

According to its banner, the version of CUPS installed on the remote host contains a number of flaws.  While the details of the flaws are currently unknown, it is alleged that an attacker could cause the application to crash, possibly executing code.

ID	Name	Product	Family	Severity
67670	Oracle Linux 5 : cups (ELSA-2008-0192)	Nessus	Oracle Linux Local Security Checks	critical
60378	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43677	CentOS 5 : cups (CESA-2008:0192)	Nessus	CentOS Local Security Checks	critical
37420	Mandriva Linux Security Advisory : cups (MDVSA-2008:081)	Nessus	Mandriva Local Security Checks	critical
31816	Fedora 7 : cups-1.2.12-10.fc7 (2008-2897)	Nessus	Fedora Local Security Checks	critical
31814	Fedora 8 : cups-1.3.6-4.fc8 (2008-2131)	Nessus	Fedora Local Security Checks	high
31785	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-598-1)	Nessus	Ubuntu Local Security Checks	critical
31754	RHEL 5 : cups (RHSA-2008:0192)	Nessus	Red Hat Local Security Checks	critical
31752	GLSA-200804-01 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31740	Slackware 12.0 / current : cups (SSA:2008-094-01)	Nessus	Slackware Local Security Checks	high
4456	CUPS < 1.3.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low
31730	CUPS < 1.3.7 Multiple Vulnerabilities	Nessus	Misc.	low
31663	Debian DSA-1530-1 : cupsys - Several vulnerabilities	Nessus	Debian Local Security Checks	critical
31621	openSUSE 10 Security Update : cups (cups-5076)	Nessus	SuSE Local Security Checks	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
4390	CUPS < 1.3.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low

Detections

Analytics

CVE-2008-0047

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

critical

critical

high

low

low

critical

high

critical

low