ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.

This updates fix several bugs, but only the security fixes are listed here :

  - CVE-2010-2941: CVSS v2 Base Score: 3.3     (AV:A/AC:L/Au:N/C:N/I:N/A:P): CWE-399 Special IPP     requests allow to crashcupsd remotely.

  - CVE-2010-0542: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P): CWE-264 A NULL pointer     dereference exists in the _WriteProlog() function of the     texttops image filter.

  - CVE-2010-1748: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:P/I:N/A:N): CWE-119 An attacker with     access to the web-interface may be able to read some     bytes of uninitialized memory.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0866 advisory.

    [1:1.4.2-35:.1]
    - Applied patch to fix cupsd memory corruption vulnerability       (CVE-2010-2941, STR #3648, bug #624438).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0811 :

Updated cups packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

A use-after-free flaw was found in the way the CUPS server parsed Internet Printing Protocol (IPP) packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server or, potentially, execute arbitrary code with the privileges of the CUPS server. (CVE-2010-2941)

A possible privilege escalation flaw was found in CUPS. An unprivileged process running as the 'lp' user (such as a compromised external filter program spawned by the CUPS server) could trick the CUPS server into overwriting arbitrary files as the root user.
(CVE-2010-2431)

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting the CVE-2010-2941 issue.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

An invalid free flaw was found in the way the CUPS server parsed Internet Printing Protocol (IPP) packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server. (CVE-2010-2941)

After installing this update, the cupsd daemon will be restarted automatically.

A use-after-free flaw was found in the way the CUPS server parsed Internet Printing Protocol (IPP) packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server or, potentially, execute arbitrary code with the privileges of the CUPS server. (CVE-2010-2941)

A possible privilege escalation flaw was found in CUPS. An unprivileged process running as the 'lp' user (such as a compromised external filter program spawned by the CUPS server) could trick the CUPS server into overwriting arbitrary files as the root user.
(CVE-2010-2431)

After installing this update, the cupsd daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201207-10 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CUPS. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code using specially       crafted streams, IPP requests or files, or cause a Denial of Service       (daemon crash or hang). A local attacker may be able to gain escalated       privileges or overwrite arbitrary files. Furthermore, a remote attacker       may be able to obtain sensitive information from the CUPS process or       hijack a CUPS administrator authentication request.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the Common UNIX Printing System :

  - CVE-2008-5183     A NULL pointer dereference in RSS job completion     notifications could lead to denial of service.

  - CVE-2009-3553     It was discovered that incorrect file descriptor     handling could lead to denial of service.

  - CVE-2010-0540     A cross-site request forgery vulnerability was     discovered in the web interface.

  - CVE-2010-0542     Incorrect memory management in the filter subsystem     could lead to denial of service.

  - CVE-2010-1748     Information disclosure in the web interface.

  - CVE-2010-2431     Emmanuel Bouillon discovered a symlink vulnerability in     handling of cache files.

  - CVE-2010-2432     Denial of service in the authentication code.

  - CVE-2010-2941     Incorrect memory management in the IPP code could lead     to denial of service or the execution of arbitrary code.

This updates fix several bugs, but only the security fixes are listed here :

  - Special IPP requests allow to crash cupsd remotely.
    (CVE-2010-2941: CVSS v2 Base Score: 3.3     (AV:A/AC:L/Au:N/C:N/I:N/A:P): CWE-399)

  - A NULL pointer dereference exists in the _WriteProlog()     function of the texttops image filter. (CVE-2010-0542:
    CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
    CWE-264)

  - An attacker with access to the web-interface may be able     to read some bytes of uninitialized memory.
    (CVE-2010-1748: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:P/I:N/A:N): CWE-119)

According to its banner, the version of CUPS installed on the remote host is prior to 1.4.5. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists due to improper allocation     of memory for attribute values with invalid string data     types. A remote attacker can exploit this, via a crafted     IPP request, to cause a denial of service condition or     the execution of arbitrary code. (CVE-2010-2941)

  - An overflow condition exists in the PPD compiler due to     improper validation of user-supplied input. A remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.

New cups packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix security issues.

Updated cups packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

A use-after-free flaw was found in the way the CUPS server parsed Internet Printing Protocol (IPP) packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server or, potentially, execute arbitrary code with the privileges of the CUPS server. (CVE-2010-2941)

A possible privilege escalation flaw was found in CUPS. An unprivileged process running as the 'lp' user (such as a compromised external filter program spawned by the CUPS server) could trick the CUPS server into overwriting arbitrary files as the root user.
(CVE-2010-2431)

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting the CVE-2010-2941 issue.

Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

This update fixes a cupsd memory corruption vulnerability (CVE-2010-2941).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a cupsd memory corruption vulnerability (CVE-2010-2941), as well as fixing a crash when the MIME database cannot be loaded for any reason.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0866 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer     for UNIX operating systems.

    An invalid free flaw was found in the way the CUPS server parsed Internet     Printing Protocol (IPP) packets. A malicious user able to send IPP requests     to the CUPS server could use this flaw to crash the CUPS server.
    (CVE-2010-2941)

    Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for     reporting this issue.

    Users of cups are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing this     update, the cupsd daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered and corrected in cups :

Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540).

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities were discovered and corrected in cups :

Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540).

The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file (CVE-2010-0542).

The web interface in CUPS, reads uninitialized memory during handling of form variables, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via unspecified vectors (CVE-2010-1748).

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file (CVE-2010-2431).

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. 

This security update contains fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - ImageIO
  - Image RAW
  - MySQL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - Safari RSS
  - Wiki Server
  - X11

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

Emmanuel Bouillon discovered that CUPS did not properly handle certain Internet Printing Protocol (IPP) packets. A remote attacker could use this flaw to cause a denial of service or possibly execute arbitrary code. In the default installation in Ubuntu 8.04 LTS and later, attackers would be isolated by the CUPS AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75456	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
68140	Oracle Linux 6 : cups (ELSA-2010-0866)	Nessus	Oracle Linux Local Security Checks	critical
68130	Oracle Linux 5 : cups (ELSA-2010-0811)	Nessus	Oracle Linux Local Security Checks	high
60888	Scientific Linux Security Update : cups on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60881	Scientific Linux Security Update : cups on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59902	GLSA-201207-10 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53703	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
53654	openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)	Nessus	SuSE Local Security Checks	high
52484	Debian DSA-2176-1 : cups - several vulnerabilities	Nessus	Debian Local Security Checks	high
50983	SuSE 11 / 11.1 Security Update : CUPS (SAT Patch Numbers 3575 / 3576)	Nessus	SuSE Local Security Checks	high
50844	CUPS < 1.4.5 Multiple Vulnerabilities	Nessus	Misc.	critical
50832	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : cups (SSA:2010-333-01)	Nessus	Slackware Local Security Checks	high
50802	CentOS 5 : cups (CESA-2010:0811)	Nessus	CentOS Local Security Checks	high
50685	Fedora 12 : cups-1.4.4-11.fc12 (2010-17627)	Nessus	Fedora Local Security Checks	high
50684	Fedora 13 : cups-1.4.4-11.fc13 (2010-17615)	Nessus	Fedora Local Security Checks	high
50638	RHEL 6 : cups (RHSA-2010:0866)	Nessus	Red Hat Local Security Checks	critical
50618	Fedora 14 : cups-1.4.4-11.fc14 (2010-17641)	Nessus	Fedora Local Security Checks	high
50607	Mandriva Linux Security Advisory : cups (MDVSA-2010:233)	Nessus	Mandriva Local Security Checks	high
50606	Mandriva Linux Security Advisory : cups (MDVSA-2010:232)	Nessus	Mandriva Local Security Checks	high
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50549	Mac OS X Multiple Vulnerabilities (Security Update 2010-007)	Nessus	MacOS X Local Security Checks	critical
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
50490	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : cups, cupsys vulnerability (USN-1012-1)	Nessus	Ubuntu Local Security Checks	high
50407	RHEL 5 : cups (RHSA-2010:0811)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-2941

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

critical

high

high

high

high

critical

high

high

high

critical

critical

critical

high

high