cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-1029 advisory.

    [1.2.4-11.18:.3]
    - Applied patch to fix RSS subscription limiting (bug #473901,       CVE-2008-5183).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A NULL pointer dereference flaw was found in the way CUPS handled subscriptions for printing job completion notifications. A local user could use this flaw to crash the CUPS daemon by submitting a large number of printing jobs requiring mail notification on completion, leading to a denial of service. (CVE-2008-5183)

An integer overflow flaw, leading to a heap buffer overflow, was discovered in the Portable Network Graphics (PNG) decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious PNG file that could, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-5286)

Several vulnerabilities have been discovered in the Common UNIX Printing System :

  - CVE-2008-5183     A NULL pointer dereference in RSS job completion     notifications could lead to denial of service.

  - CVE-2009-3553     It was discovered that incorrect file descriptor     handling could lead to denial of service.

  - CVE-2010-0540     A cross-site request forgery vulnerability was     discovered in the web interface.

  - CVE-2010-0542     Incorrect memory management in the filter subsystem     could lead to denial of service.

  - CVE-2010-1748     Information disclosure in the web interface.

  - CVE-2010-2431     Emmanuel Bouillon discovered a symlink vulnerability in     handling of cache files.

  - CVE-2010-2432     Denial of service in the authentication code.

  - CVE-2010-2941     Incorrect memory management in the IPP code could lead     to denial of service or the execution of arbitrary code.

Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

A NULL pointer dereference flaw was found in the way CUPS handled subscriptions for printing job completion notifications. A local user could use this flaw to crash the CUPS daemon by submitting a large number of printing jobs requiring mail notification on completion, leading to a denial of service. (CVE-2008-5183)

Users of cups should upgrade to these updated packages, which contain a backported patch to correct this issue.

local users could crash cups by adding a large number of RSS subscriptions (CVE-2008-5183, CVE-2008-5184).

It was discovered that CUPS didn't properly handle adding a large number of RSS subscriptions. A local user could exploit this and cause CUPS to crash, leading to a denial of service. This issue only applied to Ubuntu 7.10, 8.04 LTS and 8.10. (CVE-2008-5183)

It was discovered that CUPS did not authenticate users when adding and cancelling RSS subscriptions. An unprivileged local user could bypass intended restrictions and add a large number of RSS subscriptions.
This issue only applied to Ubuntu 7.10 and 8.04 LTS. (CVE-2008-5184)

It was discovered that the PNG filter in CUPS did not properly handle certain malformed images. If a user or automated system were tricked into opening a crafted PNG image file, a remote attacker could cause a denial of service or execute arbitrary code with user privileges. In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-5286)

It was discovered that the example pstopdf CUPS filter created log files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. (CVE-2008-5377).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security update to fix CVE-2008-5183. Also changed in this update: * a bug that caused cups-polld to fail to resolve hostnames has been fixed
* a bug that could cause libcups to get stuck in a loop has been fixed
* the dnssd backend has been removed as it is not working correctly and can prevent printers being added

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities have been discovered and corrected in CUPS.

CUPS before 1.3.8 allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference (CVE-2008-5183).

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions (CVE-2008-5184).

CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow (CVE-2008-5286).

CUPS shipped with Mandriva Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file (CVE-2009-0032).

The updated packages have been patched to prevent this.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

Security update to fix CVE-2008-5183. Also fixed in this update are a bug that caused cups-polld to fail to resolve hostnames, a bug that could cause libcups to get stuck in a loop, and incorrect form-feed handling in the textonly filter.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security update to fix CVE-2008-5183. Also included is a fix for incorrect form-feed handling in the textonly filter.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67776	Oracle Linux 5 : cups (ELSA-2008-1029)	Nessus	Oracle Linux Local Security Checks	high
60503	Scientific Linux Security Update : cups on SL3.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
52484	Debian DSA-2176-1 : cups - several vulnerabilities	Nessus	Debian Local Security Checks	high
43720	CentOS 5 : cups (CESA-2008:1029)	Nessus	CentOS Local Security Checks	medium
39942	openSUSE Security Update : cups (cups-322)	Nessus	SuSE Local Security Checks	critical
38132	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : cups, cupsys vulnerabilities (USN-707-1)	Nessus	Ubuntu Local Security Checks	critical
38122	Fedora 10 : cups-1.3.9-4.fc10 (2008-10895)	Nessus	Fedora Local Security Checks	medium
36414	Mandriva Linux Security Advisory : cups (MDVSA-2009:028)	Nessus	Mandriva Local Security Checks	critical
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
35183	RHEL 5 : cups (RHSA-2008:1029)	Nessus	Red Hat Local Security Checks	medium
35079	Fedora 9 : cups-1.3.9-2.fc9 (2008-10917)	Nessus	Fedora Local Security Checks	medium
35078	Fedora 8 : cups-1.3.9-2.fc8 (2008-10911)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5183

high

Tenable Plugins

high

high

high

medium

critical

critical

medium

critical

critical

medium

medium

medium