Use-after-free vulnerability in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (crash) via crafted IPP packets.

From Red Hat Security Advisory 2008:0161 :

Updated cups packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. (CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

These issues were found during the investigation of CVE-2008-0882, which did not affect Red Hat Enterprise Linux 4.

Note that the default configuration of CUPS on Red Hat Enterprise Linux 4 allow requests of this type only from the local subnet.

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2008:0153 :

Updated cups packages that fixes two security issues and a bug are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. (CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

These issues were found during the investigation of CVE-2008-0882, which did not affect Red Hat Enterprise Linux 3.

Note that the default configuration of CUPS on Red Hat Enterprise Linux 3 allow requests of this type only from the local subnet.

In addition, these updated cups packages fix a bug that occurred when using the CUPS polling daemon. Excessive debugging log information was saved to the error_log file regardless of the LogLevel setting, which filled up disk space rapidly.

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

SL 3 and SL 4 only A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash.
(CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

SL 5 only A flaw was found in the way CUPS handles the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to crash.
(CVE-2008-0882)

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too. (CVE-2008-0596, CVE-2008-0597)

A flaw was found in how CUPS handled the addition and removal of remote printers via IPP that could allow a remote attacker to send a malicious IPP packet to the UDP port causing CUPS to crash.

The updated packages have been patched to correct these issues.

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too (CVE-2008-0596, CVE-2008-0597).

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too. (CVE-2008-0596 / CVE-2008-0597)

Updated cups packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. (CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

These issues were found during the investigation of CVE-2008-0882, which did not affect Red Hat Enterprise Linux 4.

Note that the default configuration of CUPS on Red Hat Enterprise Linux 4 allow requests of this type only from the local subnet.

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated cups packages that fixes two security issues and a bug are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. (CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

These issues were found during the investigation of CVE-2008-0882, which did not affect Red Hat Enterprise Linux 3.

Note that the default configuration of CUPS on Red Hat Enterprise Linux 3 allow requests of this type only from the local subnet.

In addition, these updated cups packages fix a bug that occurred when using the CUPS polling daemon. Excessive debugging log information was saved to the error_log file regardless of the LogLevel setting, which filled up disk space rapidly.

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

ID	Name	Product	Family	Severity
67663	Oracle Linux 4 : cups (ELSA-2008-0161)	Nessus	Oracle Linux Local Security Checks	medium
67658	Oracle Linux 3 : cups (ELSA-2008-0153)	Nessus	Oracle Linux Local Security Checks	medium
60364	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41201	SuSE9 Security Update : cups (YOU Patch Number 12099)	Nessus	SuSE Local Security Checks	critical
37194	Mandriva Linux Security Advisory : cups (MDVSA-2008:051)	Nessus	Mandriva Local Security Checks	critical
31394	openSUSE 10 Security Update : cups (cups-5064)	Nessus	SuSE Local Security Checks	critical
31393	SuSE 10 Security Update : cups (ZYPP Patch Number 5063)	Nessus	SuSE Local Security Checks	critical
31293	CentOS 4 : cups (CESA-2008:0161)	Nessus	CentOS Local Security Checks	medium
31186	RHEL 4 : cups (RHSA-2008:0161)	Nessus	Red Hat Local Security Checks	medium
31185	RHEL 3 : cups (RHSA-2008:0153)	Nessus	Red Hat Local Security Checks	medium
31168	CentOS 3 / 4 : cups (CESA-2008:0153)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-0597

high

Tenable Plugins

medium

medium

critical

critical

critical

critical

critical

medium

medium

medium

medium