Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.

From Red Hat Security Advisory 2008:0206 :

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0192 advisory.

    - Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117).
    - Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

SL5 Only: A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

SL 3 &amp; 4 Only: It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Scientific Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)

Red Hat would like to thank 'regenrecht' for reporting this issue.

This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

- specially crafted GIF files could cause a buffer     overflow in the printer filter for image files.
    (CVE-2008-1373)

  - specially crafted files could cause a buffer overflow in     the HP-GL/2 printer filter. (CVE-2008-0053)

A heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047).

A validation error in the Hp-GL/2 filter was also discovered (CVE-2008-0053).

Finally, a vulnerability in how CUPS handled GIF files was found by Tomas Hoger of Red Hat, similar to previous issues corrected in PHP, gd, tk, netpbm, and SDL_image (CVE-2008-1373).

The updated packages have been patched to correct these issues.

Several remote vulnerabilities have been discovered in the Common Unix Printing System (CUPS). The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0053     Buffer overflows in the HP-GL input filter allowed to     possibly run arbitrary code through crafted HP-GL files.

  - CVE-2008-1373     Buffer overflow in the GIF filter allowed to possibly     run arbitrary code through crafted GIF files.

  - CVE-2008-1722     Integer overflows in the PNG filter allowed to possibly     run arbitrary code through crafted PNG files.

Three security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation * A buffer overflow when processing HP-GL/2 files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)

It was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0053)

It was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0882)

It was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- specially crafted GIF files could cause a buffer     overflow in the printer filter for image files     (CVE-2008-1373).

  - specially crafted files could cause a buffer overflow in     the HP-GL/2 printer filter (CVE-2008-0053).

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200804-01 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in CUPS:
    regenrecht (VeriSign iDefense) discovered that the     cgiCompileSearch() function used in several CGI scripts in CUPS'     administration interface does not correctly calculate boundaries when     processing a user-provided regular expression, leading to a heap-based     buffer overflow (CVE-2008-0047).
    Helge Blischke reported a     double free() vulnerability in the process_browse_data() function when     adding or removing remote shared printers (CVE-2008-0882).
    Tomas Hoger (Red Hat) reported that the gif_read_lzw() function     uses the code_size value from GIF images without properly checking it,     leading to a buffer overflow (CVE-2008-1373).
    An unspecified     input validation error was discovered in the HP-GL/2 filter     (CVE-2008-0053).
  Impact :

    A local attacker could send specially crafted network packets or print     jobs and possibly execute arbitrary code with the privileges of the     user running CUPS (usually lp), or cause a Denial of Service. The     vulnerabilities are exploitable via the network when CUPS is sharing     printers remotely.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

According to its banner, the version of CUPS installed on the remote host contains a number of flaws.  While the details of the flaws are currently unknown, it is alleged that an attacker could cause the application to crash, possibly executing code.

ID	Name	Product	Family	Severity
67674	Oracle Linux 3 / 4 : cups (ELSA-2008-0206)	Nessus	Oracle Linux Local Security Checks	critical
67670	Oracle Linux 5 : cups (ELSA-2008-0192)	Nessus	Oracle Linux Local Security Checks	critical
60378	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43677	CentOS 5 : cups (CESA-2008:0192)	Nessus	CentOS Local Security Checks	critical
41203	SuSE9 Security Update : CUPS (YOU Patch Number 12117)	Nessus	SuSE Local Security Checks	critical
37420	Mandriva Linux Security Advisory : cups (MDVSA-2008:081)	Nessus	Mandriva Local Security Checks	critical
33774	Debian DSA-1625-1 : cupsys - buffer overflows	Nessus	Debian Local Security Checks	critical
31816	Fedora 7 : cups-1.2.12-10.fc7 (2008-2897)	Nessus	Fedora Local Security Checks	critical
31785	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-598-1)	Nessus	Ubuntu Local Security Checks	critical
31770	openSUSE 10 Security Update : cups (cups-5117)	Nessus	SuSE Local Security Checks	critical
31769	SuSE 10 Security Update : CUPS (ZYPP Patch Number 5115)	Nessus	SuSE Local Security Checks	critical
31756	RHEL 3 / 4 : cups (RHSA-2008:0206)	Nessus	Red Hat Local Security Checks	critical
31754	RHEL 5 : cups (RHSA-2008:0192)	Nessus	Red Hat Local Security Checks	critical
31752	GLSA-200804-01 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31741	CentOS 3 / 4 : cups (CESA-2008:0206)	Nessus	CentOS Local Security Checks	critical
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
4390	CUPS < 1.3.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low

Detections

Analytics

CVE-2008-0053

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

low