The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.

Updated cups-filters packages fix security vulnerabilities :

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6473).

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6474, CVE-2013-6475).

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6476).

Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands on a server running the cups-browsed daemon (CVE-2014-2707).

In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337).

In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338).

The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336).

Note that only systems that have enabled the affected feature by using the CreateIPPPrinterQueues configuration directive in /etc/cups/cups-browsed.conf were affected by the CVE-2014-2707 / CVE-2014-4336 issue.

Updated cups-filters packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The cups-filters package contains backends, filters, and other software that was once part of the core CUPS distribution but is now maintained independently.

An out-of-bounds read flaw was found in the way the process_browse_data() function of cups-browsed handled certain browse packets. A remote attacker could send a specially crafted browse packet that, when processed by cups-browsed, would crash the cups-browsed daemon. (CVE-2014-4337)

A flaw was found in the way the cups-browsed daemon interpreted the 'BrowseAllow' directive in the cups-browsed.conf file. An attacker able to add a malformed 'BrowseAllow' directive to the cups-browsed.conf file could use this flaw to bypass intended access restrictions. (CVE-2014-4338)

All cups-filters users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing this update, the cups-browsed daemon will be restarted automatically.

An out-of-bounds read flaw was found in the way the process_browse_data() function of cups-browsed handled certain browse packets. A remote attacker could send a specially crafted browse packet that, when processed by cups- browsed, would crash the cups-browsed daemon. (CVE-2014-4337)

A flaw was found in the way the cups-browsed daemon interpreted the 'BrowseAllow' directive in the cups-browsed.conf file. An attacker able to add a malformed 'BrowseAllow' directive to the cups-browsed.conf file could use this flaw to bypass intended access restrictions. (CVE-2014-4338)

After installing this update, the cups-browsed daemon will be restarted automatically.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1795 advisory.

    - Applied upstream patch to fix BrowseAllow parsing issue       (CVE-2014-4338, bug #1091568).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
82353	Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:100)	Nessus	Mandriva Local Security Checks	high
78860	CentOS 7 : cups-filters (CESA-2014:1795)	Nessus	CentOS Local Security Checks	medium
78855	Scientific Linux Security Update : cups-filters on SL7.x x86_64 (20141103)	Nessus	Scientific Linux Local Security Checks	medium
78840	RHEL 7 : cups-filters (RHSA-2014:1795)	Nessus	Red Hat Local Security Checks	medium
78838	Oracle Linux 7 : cups-filters (ELSA-2014-1795)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2014-4337

high

Tenable Plugins

high

medium

medium

medium

high