foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Also consider back tick and semicolon as illegal shell     escape characters.

  - CVE-2015-8327, (CVE-2015-8560)

  - Prevent foomatic-rip overrun (bug #1214534).

The remote Solaris system is missing necessary patches to address security updates :

  - foomatic-rip-hplip in HP Linux Imaging and Printing     (HPLIP) 3.11.5 allows remote attackers to execute     arbitrary code via a crafted *FoomaticRIPCommandLine     field in a .ppd file. (CVE-2011-2697)

  - foomaticrip.c in foomatic-rip in foomatic-filters in     Foomatic 4.0.6 allows remote attackers to execute     arbitrary code via a crafted *FoomaticRIPCommandLine     field in a .ppd file, a different vulnerability than     CVE-2011-2697. (CVE-2011-2964)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user. CVE-2011-2964: CVSS v2 Base Score: 6.8 (moderate) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Code Injection (CWE-94)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1110 advisory.

    [4.0.4-1:.1]
    - Applied patch to fix improper sanitization of command line options       (CVE-2011-2697, bug #721001).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in C.

An input sanitization flaw was found in the foomatic-rip print filter.
An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the 'lp' user. (CVE-2011-2964)

All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue.

The remote host is affected by the vulnerability described in GLSA-201203-07 (foomatic-filters: User-assisted execution of arbitrary code)

    The foomatic-rip filter improperly handles command-line arguments,       including those issued by FoomaticRIPCommandLine fields in PPD files.
  Impact :

    A remote attacker could entice a user to open a specially crafted PPD       file, possibly resulting in execution of arbitrary code with the       privileges of the system user 'lp'.
  Workaround :

    There is no known workaround at this time.

It was discovered that the foomatic-filters, a support package for setting up printers, allowed authenticated users to submit crafted print jobs which would execute shell commands on the print servers.

 CVE-2011-2697 was assigned to the vulnerability in the Perl  implementation included in lenny, and CVE-2011-2964 to the  vulnerability affecting the C reimplementation part of squeeze.

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

CVE-2011-2697: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
Input Validation (CWE-20)

It was discovered that the foomatic-rip Foomatic filter incorrectly handled command-line options. An attacker could use this flaw to cause Foomatic to execute arbitrary code as the 'lp' user.

In the default installation, attackers would be isolated by the CUPS AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes improper sanitization of command line options.
(CVE-2011-2964)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in foomatic-filters :

foomatic-rip allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file (CVE-2011-2697, CVE-2011-2964).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

  - CVE-2011-2697: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P) : Input Validation (CWE-20)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

  - CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
    Input Validation (CWE-20). (CVE-2011-2697)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1110 advisory.

  - foomatic: Improper sanitization of command line option in foomatic-rip (foomatic.c) (CVE-2011-2964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
90139	OracleVM 3.3 / 3.4 : foomatic (OVMSA-2016-0040)	Nessus	OracleVM Local Security Checks	high
80613	Oracle Solaris Third-Party Patch Update : foomatic (multiple_vulnerabilities_in_foomatic)	Nessus	Solaris Local Security Checks	medium
75843	openSUSE Security Update : foomatic-filters (openSUSE-SU-2011:0892-1)	Nessus	SuSE Local Security Checks	medium
75503	openSUSE Security Update : foomatic-filters (openSUSE-SU-2011:0892-1)	Nessus	SuSE Local Security Checks	medium
68320	Oracle Linux 6 : foomatic (ELSA-2011-1110)	Nessus	Oracle Linux Local Security Checks	high
61104	Scientific Linux Security Update : foomatic on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58217	GLSA-201203-07 : foomatic-filters: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
57520	Debian DSA-2380-1 : foomatic-filters - shell command injection	Nessus	Debian Local Security Checks	medium
57196	SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7677)	Nessus	SuSE Local Security Checks	medium
55957	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : foomatic-filters vulnerabilities (USN-1194-1)	Nessus	Ubuntu Local Security Checks	medium
55874	Fedora 14 : foomatic-4.0.7-2.fc14 (2011-9575)	Nessus	Fedora Local Security Checks	medium
55873	Fedora 15 : foomatic-4.0.7-3.fc15 (2011-9554)	Nessus	Fedora Local Security Checks	medium
55849	Mandriva Linux Security Advisory : foomatic-filters (MDVSA-2011:125)	Nessus	Mandriva Local Security Checks	medium
55830	SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7676)	Nessus	SuSE Local Security Checks	medium
55829	SuSE 11.1 Security Update : foomatic-filters (SAT Patch Number 4966)	Nessus	SuSE Local Security Checks	medium
55826	SuSE9 Security Update : foomatic-filters (YOU Patch Number 12818)	Nessus	SuSE Local Security Checks	medium
55756	RHEL 6 : foomatic (RHSA-2011:1110)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-2964

high

Tenable Plugins

high

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high