The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

This updates fix several bugs, but only the security fixes are listed here :

  - CVE-2010-2941: CVSS v2 Base Score: 3.3     (AV:A/AC:L/Au:N/C:N/I:N/A:P): CWE-399 Special IPP     requests allow to crashcupsd remotely.

  - CVE-2010-0542: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P): CWE-264 A NULL pointer     dereference exists in the _WriteProlog() function of the     texttops image filter.

  - CVE-2010-1748: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:P/I:N/A:N): CWE-119 An attacker with     access to the web-interface may be able to read some     bytes of uninitialized memory.

From Red Hat Security Advisory 2010:0490 :

Updated cups packages that fix three security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The CUPS 'texttops' filter converts text files to PostScript.

A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542)

A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540)

Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface.

An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748)

Red Hat would like to thank the Apple Product Security team for responsibly reporting these issues. Upstream acknowledges regenrecht as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters of CVE-2010-0540; and Luca Carettoni as the original reporter of CVE-2010-1748.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542)

A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540)

Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface.

An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748)

After installing this update, the cupsd daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201207-10 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CUPS. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code using specially       crafted streams, IPP requests or files, or cause a Denial of Service       (daemon crash or hang). A local attacker may be able to gain escalated       privileges or overwrite arbitrary files. Furthermore, a remote attacker       may be able to obtain sensitive information from the CUPS process or       hijack a CUPS administrator authentication request.
  Workaround :

    There is no known workaround at this time.

New cups packages are available for Slackware 13.1 and -current to fix security issues.

Several vulnerabilities have been discovered in the Common UNIX Printing System :

  - CVE-2008-5183     A NULL pointer dereference in RSS job completion     notifications could lead to denial of service.

  - CVE-2009-3553     It was discovered that incorrect file descriptor     handling could lead to denial of service.

  - CVE-2010-0540     A cross-site request forgery vulnerability was     discovered in the web interface.

  - CVE-2010-0542     Incorrect memory management in the filter subsystem     could lead to denial of service.

  - CVE-2010-1748     Information disclosure in the web interface.

  - CVE-2010-2431     Emmanuel Bouillon discovered a symlink vulnerability in     handling of cache files.

  - CVE-2010-2432     Denial of service in the authentication code.

  - CVE-2010-2941     Incorrect memory management in the IPP code could lead     to denial of service or the execution of arbitrary code.

This update fixes the following vulnerabilities in cups :

  - A specially crafted PDF file could crash the pdftops     potentially even cause execution of arbitrary code.
    (CVE-2010-3702: CVSS v2 Base Score: 5.8).
    (CVE-2010-3702)

  - A NULL pointer dereference issue exists in the
    _WriteProlog function of texttops. (CVE-2010-0542: CVSS     v2 Base Score: 6.8: Permissions, Privileges, and Access     Control (CWE-264)). (CVE-2010-0542)

  - Memory disclosure in web interface. (CVE-2010-1748: CVSS     v2 Base Score: 4.3: Buffer Errors (CWE-119)).
    (CVE-2010-1748)

This updates fix several bugs, but only the security fixes are listed here :

  - Special IPP requests allow to crash cupsd remotely.
    (CVE-2010-2941: CVSS v2 Base Score: 3.3     (AV:A/AC:L/Au:N/C:N/I:N/A:P): CWE-399)

  - A NULL pointer dereference exists in the _WriteProlog()     function of the texttops image filter. (CVE-2010-0542:
    CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
    CWE-264)

  - An attacker with access to the web-interface may be able     to read some bytes of uninitialized memory.
    (CVE-2010-1748: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:P/I:N/A:N): CWE-119)

Multiple vulnerabilities were discovered and corrected in cups :

Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540).

The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file (CVE-2010-0542).

The web interface in CUPS, reads uninitialized memory during handling of form variables, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via unspecified vectors (CVE-2010-1748).

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file (CVE-2010-2431).

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

New upstream release fixing several security issues: CVE-2010-0540, CVE-2010-0542, CVE-2010-1748.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CUPS install contains a memory information disclosure vulnerability due to an error in 'cgi_initialize_string' in 'cgi-bin/var.c', which mishandles input parameters containing the '%' character.

According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.4. Such versions are affected by several vulnerabilities :

  - The patch for STR #3200 / CVE-2009-3553 was not     complete. A remote client can cause a denial of service     by causing the CUPS server to reference an already     freed resource. (STR #3490) (CVE-2010-0302)

  - The CUPS daemon may be vulnerable to certain cross-site     request forgery (CSRF) attacks, e.g., malicious IFRAME     attacks. (STR #3498) (CVE-2010-0540)

  - An unprivileged process may be able to cause the CUPS     server to overwrite arbitrary files as the root user.
    (STR #3510) (CVE-2010-2431)

  - The CUPS daemon is vulnerable to a heap corruption     attack as the 'textops' filter does not verify the     results of memory allocations. It is possible this     may lead to arbitrary code execution. (STR #3516)     (CVE-2010-0542)

  - The CUPS daemon is vulnerable to a denial of service     attack if compiled without HAVE_GSSAPI. (STR #3518)     (CVE-2010-2432)

  - The CUPS daemon is vulnerable to an information     disclosure attack as an attacker can view portions of     uninitialized memory by a specially crafted URL.
    (STR #3577) (CVE-2010-1748)

Adrian Pastor and Tim Starling discovered that the CUPS web interface incorrectly protected against cross-site request forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while logged into CUPS, a remote attacker could modify the CUPS configuration and possibly steal confidential data.
(CVE-2010-0540)

It was discovered that CUPS did not properly handle memory allocations in the texttops filter. If a user or automated system were tricked into printing a crafted text file, a remote attacker could cause a denial of service or possibly execute arbitrary code with privileges of the CUPS user (lp). (CVE-2010-0542)

Luca Carettoni discovered that the CUPS web interface incorrectly handled form variables. A remote attacker who had access to the CUPS web interface could use this flaw to read a limited amount of memory from the cupsd process and possibly obtain confidential data.
(CVE-2010-1748).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cups packages that fix three security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The CUPS 'texttops' filter converts text files to PostScript.

A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542)

A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540)

Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface.

An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748)

Red Hat would like to thank the Apple Product Security team for responsibly reporting these issues. Upstream acknowledges regenrecht as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters of CVE-2010-0540; and Luca Carettoni as the original reporter of CVE-2010-1748.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

The remote host is running CUPS, an open source print server. 

Versions of CUPS earlier than 1.4.4 are potentially affected by multiple vulnerabilities.

  - The texttops filter does not check the results of memory allocations. (STR #3715)

  - A use-after-free vulnerability in the abstract file-descriptor handling interface.  Note that this is related to an incomplete patch for CVE-2009-3553. (STR #3490)

  - In certain instances, the web interface can disclose the contents of memory. (STR #3577)

  - CUPS can overwrite files as root in directories not owned or writeable by non-root users. (STR #3510)

  - An infinite loop can occur when CUPS is not compiled with HAVE_GSSAPI. (STR #3518)

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

ID	Name	Product	Family	Severity
75456	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
68052	Oracle Linux 3 / 4 / 5 : cups (ELSA-2010-0490)	Nessus	Oracle Linux Local Security Checks	medium
60806	Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59902	GLSA-201207-10 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
54882	Slackware 13.1 / current : cups (SSA:2010-176-05)	Nessus	Slackware Local Security Checks	medium
53703	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
53654	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
52484	Debian DSA-2176-1 : cups - several vulnerabilities	Nessus	Debian Local Security Checks	high
50984	SuSE 10 Security Update : CUPS (ZYPP Patch Number 7244)	Nessus	SuSE Local Security Checks	medium
50983	SuSE 11 / 11.1 Security Update : CUPS (SAT Patch Numbers 3575 / 3576)	Nessus	SuSE Local Security Checks	high
50982	SuSE9 Security Update : CUPS (YOU Patch Number 12665)	Nessus	SuSE Local Security Checks	medium
50606	Mandriva Linux Security Advisory : cups (MDVSA-2010:232)	Nessus	Mandriva Local Security Checks	high
47835	Fedora 12 : cups-1.4.4-5.fc12 (2010-10101)	Nessus	Fedora Local Security Checks	medium
47716	CUPS Memory Information Disclosure	Nessus	Web Servers	medium
47683	CUPS < 1.4.4 Multiple Vulnerabilities	Nessus	Misc.	high
47586	Fedora 13 : cups-1.4.4-5.fc13 (2010-10388)	Nessus	Fedora Local Security Checks	medium
47206	Fedora 11 : cups-1.4.4-4.fc11 (2010-10066)	Nessus	Fedora Local Security Checks	medium
47108	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : cups, cupsys vulnerabilities (USN-952-1)	Nessus	Ubuntu Local Security Checks	medium
47102	CentOS 3 / 4 / 5 : cups (CESA-2010:0490)	Nessus	CentOS Local Security Checks	medium
5574	CUPS < 1.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
47044	RHEL 3 / 4 / 5 : cups (RHSA-2010:0490)	Nessus	Red Hat Local Security Checks	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-1748

medium

Tenable Plugins

high

medium

medium

high

medium

high

high

high

medium

high

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

high

critical

high

high