Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0157 advisory.

    [1.2.4-11.14:.4]
     - Prevent double-free when a browsed class has the same name as a printer        or vice versa (bug #433766, STR #2656).

     [1.2.4-11.14:.3]
     - pdftops: Fix invalid dereference from bad Info object (found during      testing        of bug #356571).

     [1.2.4-11.14:.2]
     - Applied patch to fix CVE-2007-4045 (bug #356571).
     - Applied patch to fix CVE-2007-4352, CVE-2007-5392 and        CVE-2007-5393 (bug #356571).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SL 3 and SL 4 only A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash.
(CVE-2008-0597)

A memory management flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. When shared printer was removed, allocated memory was not properly freed, leading to a memory leak possibly causing CUPS daemon crash after exhausting available memory. (CVE-2008-0596)

SL 5 only A flaw was found in the way CUPS handles the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to crash.
(CVE-2008-0882)

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too. (CVE-2008-0596, CVE-2008-0597)

A flaw was found in how CUPS handled the addition and removal of remote printers via IPP that could allow a remote attacker to send a malicious IPP packet to the UDP port causing CUPS to crash.

The updated packages have been patched to correct these issues.

It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)

It was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0053)

It was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0882)

It was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200804-01 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in CUPS:
    regenrecht (VeriSign iDefense) discovered that the     cgiCompileSearch() function used in several CGI scripts in CUPS'     administration interface does not correctly calculate boundaries when     processing a user-provided regular expression, leading to a heap-based     buffer overflow (CVE-2008-0047).
    Helge Blischke reported a     double free() vulnerability in the process_browse_data() function when     adding or removing remote shared printers (CVE-2008-0882).
    Tomas Hoger (Red Hat) reported that the gif_read_lzw() function     uses the code_size value from GIF images without properly checking it,     leading to a buffer overflow (CVE-2008-1373).
    An unspecified     input validation error was discovered in the HP-GL/2 filter     (CVE-2008-0053).
  Impact :

    A local attacker could send specially crafted network packets or print     jobs and possibly execute arbitrary code with the privileges of the     user running CUPS (usually lp), or cause a Denial of Service. The     vulnerabilities are exploitable via the network when CUPS is sharing     printers remotely.
  Workaround :

    There is no known workaround at this time.

Several local/remote vulnerabilities have been discovered in cupsys, the Common Unix Printing System. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0047     Heap-based buffer overflow in CUPS, when printer sharing     is enabled, allows remote attackers to execute arbitrary     code via crafted search expressions.

  - CVE-2008-0882     Double free vulnerability in the process_browse_data     function in CUPS 1.3.5 allows remote attackers to cause     a denial of service (daemon crash) and possibly the     execution of arbitrary code via crafted packets to the     cupsd port (631/udp), related to an unspecified     manipulation of a remote printer.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too (CVE-2008-0596, CVE-2008-0597).

This update of cups fixes a denial-of-service bug (double-free) (CVE-2008-0882) and specially crafted IPP packets can make cups crash too. (CVE-2008-0596 / CVE-2008-0597)

This update contains a back-ported fix for a security issue that may cause cups daemon to crash via special browse requests (CVE-2008-0882, #433758, SA28994, STR#2656).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates CUPS to the latest stable version. Upstream version contains a fix for a security issue that may cause cups daemon to crash via special browse requests (CVE-2008-0882, #433758, SA28994, STR#2656).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. The Internet Printing Protocol (IPP) is a standard network protocol for remote printing, as well as managing print jobs.

A flaw was found in the way CUPS handles the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to crash. (CVE-2008-0882)

Note: the default configuration of CUPS on Red Hat Enterprise Linux 5 will only accept requests of this type from the local subnet. This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.

All cups users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

According to its banner, the version of CUPS installed on the remote host contains a number of flaws.  While the details of the flaws are currently unknown, it is alleged that an attacker could cause the application to crash, possibly executing code.

According to its banner, the version of CUPS installed on the remote host contains a double free error in its 'process_browse_data' function when deleting the mime type entry for a remote printer that is being polled. An attacker may be able to leverage this issue to crash the affected service by deleting a printer under his control and then recreating it as a class.

Third-party researchers suggest this vulnerability can be used to execute arbitrary code.

ID	Name	Product	Family	Severity
67661	Oracle Linux 5 : Important: / cups (ELSA-2008-0157)	Nessus	Oracle Linux Local Security Checks	critical
60364	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41201	SuSE9 Security Update : cups (YOU Patch Number 12099)	Nessus	SuSE Local Security Checks	critical
37194	Mandriva Linux Security Advisory : cups (MDVSA-2008:051)	Nessus	Mandriva Local Security Checks	critical
31785	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-598-1)	Nessus	Ubuntu Local Security Checks	critical
31752	GLSA-200804-01 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31663	Debian DSA-1530-1 : cupsys - Several vulnerabilities	Nessus	Debian Local Security Checks	critical
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
31394	openSUSE 10 Security Update : cups (cups-5064)	Nessus	SuSE Local Security Checks	critical
31393	SuSE 10 Security Update : cups (ZYPP Patch Number 5063)	Nessus	SuSE Local Security Checks	critical
31178	Fedora 7 : cups-1.2.12-9.fc7 (2008-1976)	Nessus	Fedora Local Security Checks	critical
31173	Fedora 8 : cups-1.3.6-2.fc8 (2008-1901)	Nessus	Fedora Local Security Checks	critical
31163	RHEL 5 : cups (RHSA-2008:0157)	Nessus	Red Hat Local Security Checks	critical
31142	CentOS 5 : cups (CESA-2008:0157)	Nessus	CentOS Local Security Checks	critical
4390	CUPS < 1.3.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low
31131	CUPS < 1.3.6 process_browse_data() Function Double Free DoS	Nessus	Misc.	low

Detections

Analytics

CVE-2008-0882

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

low

low