The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.

From Red Hat Security Advisory 2009:1083 :

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. The CUPS 'pdftops' filter converts Portable Document Format (PDF) files to PostScript. 'pdftops' is based on Xpdf and the CUPS imaging library.

A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949)

A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196)

Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791)

Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting the CVE-2009-1196 flaw.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1082 advisory.

    - Applied patch to fix CVE-2009-0791 (bug #491840).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949)

A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196)

Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791)

After installing this update, the cupsd daemon will be restarted automatically.

Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network.

A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949)

Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue.

Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the cupsd daemon will be restarted automatically.

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap. (CVE-2009-0146, CVE-2009-0147)

Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow. (CVE-2009-0163)

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to g*allocn. (CVE-2009-0165)

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory. (CVE-2009-0166)

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments (CVE-2009-0195).

Multiple integer overflows in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179. (CVE-2009-0791)

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read. (CVE-2009-0799)

Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-0800)

The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags. (CVE-2009-0949)

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-1179)

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data. (CVE-2009-1180)

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference. (CVE-2009-1181)

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-1182)

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file. (CVE-2009-1183)

Two integer overflow flaws were found in the CUPS pdftops filter. An attacker could create a malicious PDF file that would cause pdftops to crash or, potentially, execute arbitrary code as the lp user if the file was printed. (CVE-2009-3608, CVE-2009-3609)

This update corrects the problems.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The 'pdftops' was prone to several integer overflows (CVE-2009-0791).
The cups daemon could crash when receiving IPP requests with multiple unsupported tags. (CVE-2009-0949)

The following bugs have been fixed : 

  - The 'pdftops' was prone to several integer overflows.
    (CVE-2009-0791)

  - The cups daemon could crash when receiving IPP requests     with multiple unsupported tags. (CVE-2009-0949)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

The 'pdftops' was prone to several integer overflows (CVE-2009-0791).
The cups daemon could crash when receiving IPP requests with multiple unsupported tags (CVE-2009-0949).

Anibal Sacco discovered that CUPS did not properly handle certain network operations. A remote attacker could exploit this flaw and cause the CUPS server to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1083 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer     for UNIX operating systems. The Internet Printing Protocol (IPP) allows     users to print and manage printing-related tasks over a network. The CUPS     pdftops filter converts Portable Document Format (PDF) files to     PostScript. pdftops is based on Xpdf and the CUPS imaging library.

    A NULL pointer dereference flaw was found in the CUPS IPP routine, used for     processing incoming IPP requests for the CUPS scheduler. An attacker could     use this flaw to send specially-crafted IPP requests that would crash the     cupsd daemon. (CVE-2009-0949)

    A use-after-free flaw was found in the CUPS scheduler directory services     routine, used to process data about available printers and printer classes.
    An attacker could use this flaw to cause a denial of service (cupsd daemon     stop or crash). (CVE-2009-1196)

    Multiple integer overflows flaws, leading to heap-based buffer overflows,     were found in the CUPS pdftops filter. An attacker could create a     malicious PDF file that would cause pdftops to crash or, potentially,     execute arbitrary code as the lp user if the file was printed.
    (CVE-2009-0791)

    Red Hat would like to thank Anibal Sacco from Core Security Technologies     for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting     the CVE-2009-1196 flaw.

    Users of cups are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing this     update, the cupsd daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:1082 advisory.

  - cups: IPP_TAG_UNSUPPORTED handling NULL pointer dereference DoS (CVE-2009-0949)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. The CUPS 'pdftops' filter converts Portable Document Format (PDF) files to PostScript. 'pdftops' is based on Xpdf and the CUPS imaging library.

A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949)

A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196)

Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791)

Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting the CVE-2009-1196 flaw.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

Anibal Sacco discovered that cups, a general printing system for UNIX systems, suffers from NULL pointer dereference because of its handling of two consecutive IPP packets with certain tag attributes that are treated as IPP_TAG_UNSUPPORTED tags. This allows unauthenticated attackers to perform denial of service attacks by crashing the cups daemon.

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10. Such versions are affected by several issues :

  - A potential integer overflow in the PNG image validation     code in '_cupsImageReadPNG()' could allow an attacker to     crash the affected service or possibly execute arbitrary     code. (STR #2974)

  - A heap-based integer overflow exists in     '_cupsImageReadTIFF()' due to a failure to properly     validate the image height of a specially crafted TIFF     file, which can be leveraged to execute arbitrary code.
    (STR #3031)

  - The web interface may be vulnerable to DNS rebinding     attacks due to a failure to validate the HTTP Host     header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops allows remote     attackers to execute arbitrary code via a PDF file with     crafted JBIG2 symbol dictionary segments.
    (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function     'ippReadIO()' could allow an anonymous remote attacker     to crash the application via a malicious IPP request     packet with two consecutives IPP_TAG_UNSUPPORTED tags.
    (CVE-2009-0949)

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10.  Such versions are affected by multiple integer overflow vulnerabilities : 

  - A potential integer overflow in the PNG image validation code in '_cupsImageReadPNG()'. (STR #2974)

  - A heap-based integer overflow in '_cupsImageReadTIFF()'. (STR #3031)

  - The web interface may be vulnerable to DNS rebinding attacks due to a failure to validate the HTTP Host header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops. (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function 'ippReadIO()' could allow an attacker to crash the application.

ID	Name	Product	Family	Severity
67868	Oracle Linux 3 / 4 : cups (ELSA-2009-1083)	Nessus	Oracle Linux Local Security Checks	medium
67867	Oracle Linux 5 : cups (ELSA-2009-1082)	Nessus	Oracle Linux Local Security Checks	high
60592	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43754	CentOS 5 : cups (CESA-2009:1082)	Nessus	CentOS Local Security Checks	medium
42181	Mandriva Linux Security Advisory : cups (MDVSA-2009:282-1)	Nessus	Mandriva Local Security Checks	critical
41495	SuSE 10 Security Update : CUPS (ZYPP Patch Number 6279)	Nessus	SuSE Local Security Checks	medium
41304	SuSE9 Security Update : CUPS (YOU Patch Number 12434)	Nessus	SuSE Local Security Checks	medium
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	critical
39389	openSUSE 10 Security Update : cups (cups-6285)	Nessus	SuSE Local Security Checks	medium
39311	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : cups, cupsys vulnerability (USN-780-1)	Nessus	Ubuntu Local Security Checks	medium
39307	RHEL 4 : cups (RHSA-2009:1083)	Nessus	Red Hat Local Security Checks	high
39306	RHEL 5 : cups (RHSA-2009:1082)	Nessus	Red Hat Local Security Checks	high
39303	CentOS 3 / 4 : cups (CESA-2009:1083)	Nessus	CentOS Local Security Checks	medium
38992	Debian DSA-1811-1 : cups, cupsys - null ptr dereference	Nessus	Debian Local Security Checks	medium
36183	CUPS < 1.3.10 Multiple Vulnerabilities	Nessus	Misc.	high
4771	CUPS < 1.3.10 Multiple Overflows	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2009-0949

high

Tenable Plugins

medium

high

medium

medium

critical

medium

medium

critical

medium

medium

high

high

medium

medium

high

high