The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

A vulnerability has been discovered and corrected in cups :

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896 (CVE-2011-3170).

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-201207-10 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CUPS. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code using specially       crafted streams, IPP requests or files, or cause a Denial of Service       (daemon crash or hang). A local attacker may be able to gain escalated       privileges or overwrite arbitrary files. Furthermore, a remote attacker       may be able to obtain sensitive information from the CUPS process or       hijack a CUPS administrator authentication request.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security issues :

  - 601830: CSRF via admin web interface. (CVE-2010-0540)

  - 680210: users in group 'lp' can overwrite arbitrary     files. (CVE-2010-2431)

  - 711490: heap overflow in gif decoder. (CVE-2011-2896)

  - 715643: heap overflow in gif decoder (CVE-2011-3170)     This update also fixes the following non-security issues :

  - 671735: CUPS backends do not clear messages like     'Waiting for printer to finish...'

This update fixes the following security issues :

  - 601830: CSRF via admin web interface. (CVE-2010-0540)

  - 680210: users in group 'lp' can overwrite arbitrary     files. (CVE-2010-2431)

  - 680212: denial of service via cupsDoAuthentication.
    (CVE-2010-2432)

  - 711490: heap overflow in gif decoder. (CVE-2011-2896)

  - 715643: heap overflow in gif decoder (CVE-2011-3170)

Petr Sklenar and Tomas Hoger discovered that missing input sanitising in the GIF decoder inside the CUPS printing system could lead to denial of service or potentially arbitrary code execution through crafted GIF files.

Multiple vulnerabilities has been discovered and corrected in cups :

The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses (CVE-2010-2432).

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895 (CVE-2011-2896).

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896 (CVE-2011-3170).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

Tomas Hoger discovered that the CUPS image library incorrectly handled LZW streams. A remote attacker could use this flaw to cause a denial of service or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
61931	Mandriva Linux Security Advisory : cups (MDVSA-2011:147)	Nessus	Mandriva Local Security Checks	medium
59902	GLSA-201207-10 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57172	SuSE 10 Security Update : CUPS (ZYPP Patch Number 7775)	Nessus	SuSE Local Security Checks	medium
57094	SuSE 11.1 Security Update : CUPS (SAT Patch Number 5180)	Nessus	SuSE Local Security Checks	medium
56982	Debian DSA-2354-1 : cups - several vulnerabilities	Nessus	Debian Local Security Checks	medium
56603	SuSE 10 Security Update : CUPS (ZYPP Patch Number 7774)	Nessus	SuSE Local Security Checks	medium
56447	Mandriva Linux Security Advisory : cups (MDVSA-2011:146)	Nessus	Mandriva Local Security Checks	medium
56206	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : cups, cupsys vulnerabilities (USN-1207-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-3170

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium