The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.

This update fixes a typo from the previous update :

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

- Add system-config-printer-subprocess-no-shell.patch:
    avoid escaping issues when running commands. Fix     bnc#735322.

  - Add system-config-printer-no-openprinting.patch: this     disables the feature where PPD drivers can be downloaded     from OpenPrinting.org. See discussion in bnc#733542. As     a side-effect, this fixes CVE-2011-4405.

The following issues have been fixed :

  - system-config-printer used an unauthenticated connection     when downloading printer drivers from openprinting.org     (CVE-2011-4405). This update disables the printer driver     download feature.

  - system-config-printer did not properly quote shell meta     characters in SMB server or workgroup names when passing     them to the shell. (CVE-2011-2899)

Marc Deslauriers discovered that system-config-printer's cupshelpers scripts used by the Ubuntu automatic printer driver download service queried the OpenPrinting database using an insecure connection. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to install altered packages and repositories.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76002	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	high
76001	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	high
75718	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	high
75717	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	high
74537	openSUSE Security Update : system-config-printer (openSUSE-2011-89)	Nessus	SuSE Local Security Checks	high
57555	SuSE 11.1 Security Update : system-config-printer (SAT Patch Number 5607)	Nessus	SuSE Local Security Checks	high
56868	Ubuntu 11.04 / 11.10 : system-config-printer vulnerability (USN-1265-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2011-4405

high

Tenable Plugins

high

high

high

high

high

high

high