Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cups: code execution via unescape ANSI escape sequences (CVE-2014-8166)

  - cups: incorrect string reference counting (VU#810572) (CVE-2015-1158)

  - The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which     makes it easier for remote attackers to conduct DNS rebinding attacks. (CVE-2009-0164)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A cross-site scripting flaw was found in the cups web     templating engine. An attacker could use this flaw to     bypass the default configuration settings that bind the     CUPS scheduler to the 'localhost' or loopback     interface.(CVE-2015-1159)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5031)

  - A string reference count bug was found in cupsd,     causing premature freeing of string objects. An     attacker could submit a malicious print job that     exploits this flaw to dismantle ACLs protecting     privileged operations, allowing a replacement     configuration file to be uploaded, which in turn     allowed the attacker to run arbitrary code on the CUPS     server.(CVE-2015-1158)

  - A cross-site scripting (XSS) flaw was found in the CUPS     web interface. An attacker could use this flaw to     perform a cross-site scripting attack against users of     the CUPS web interface.(CVE-2014-2856)

  - A localhost.localdomain whitelist entry in valid_host()     in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by     sending POST requests to the CUPS daemon in conjunction     with DNS rebinding. The localhost.localdomain name is     often resolved via a DNS server (neither the OS nor the     web browser is responsible for ensuring that     localhost.localdomain is 127.0.0.1).(CVE-2017-18190)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5030)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-3537)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the way CUPS handled     compressed raster image files. An attacker could create     a specially crafted image file that, when passed via     the CUPS Raster filter, could cause the CUPS filter to     crash.(CVE-2014-9679)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-06 (CUPS: Buffer overflow)

    A vulnerability has been discovered in CUPS concerning the handling of       compressed raster files.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

Red Hat would like to thank the CERT/CC for reporting CVE-2015-1158 and CVE-2015-1159 issues.

All cups users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

After installing this update, the cupsd daemon will be restarted automatically.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-1158, CVE-2015-1159, CVE-2014-9679 (bug     #1229982).

From Red Hat Security Advisory 2015:1123 :

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

Red Hat would like to thank the CERT/CC for reporting CVE-2015-1158 and CVE-2015-1159 issues.

All cups users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

Updated cups packages fix security vulnerabilities :

Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function (CVE-2014-2856).

In CUPS before 1.7.4, a local user with privileges of group=lp can write symbolic links in the rss directory and use that to gain '@SYSTEM' group privilege with cupsd (CVE-2014-3537).

It was discovered that the web interface in CUPS incorrectly validated permissions on rss files and directory index files. A local attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege escalation (CVE-2014-5029, CVE-2014-5030, CVE-2014-5031).

A malformed file with an invalid page header and compressed raster data can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).

Peter De Wachter discovered that CUPS, the Common UNIX Printing System, did not correctly parse compressed raster files. By submitting a specially crafted raster file, a remote attacker could use this vulnerability to trigger a buffer overflow.

For the oldstable distribution (squeeze), this problem has been fixed in version 1.4.4-7+squeeze7.

For the stable distribution (wheezy), this problem has been fixed in version 1.5.3-5+deb7u5.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

cups has been updated to fix one security issue :

  - A malformed compressed raster file can trigger a buffer     overflow in cupsRasterReadPixels. (bnc#917799).
    (CVE-2014-9679)

Updated cups packages fix security vulnerability :

A malformed file with an invalid page header and compressed raster data can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2520-1 advisory.

    Peter De Wachter discovered that CUPS incorrectly handled certain malformed compressed raster files. A     remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

cups was updated to fix one security issue.

This security issue was fixed :

  - CVE-2014-9679: A malformed compressed raster file can     trigger a buffer overflow in cupsRasterReadPixels     (bnc#917799).

Peter De Wachter discovered that CUPS, the Common UNIX Printing System, did not correctly parse compressed raster files. By submitting a specially crafted raster file, a remote attacker could use this vulnerability to trigger a buffer overflow.

This update fixes CVE-2014-9679, a buffer overflow when handling CUPS Raster format.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198649	RHEL 5 : cups (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124935	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1432)	Nessus	Huawei Local Security Checks	high
92350	GLSA-201607-06 : CUPS: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
84595	Amazon Linux AMI : cups (ALAS-2015-559)	Nessus	Amazon Linux Local Security Checks	critical
84276	CentOS 6 / 7 : cups (CESA-2015:1123)	Nessus	CentOS Local Security Checks	critical
84259	Scientific Linux Security Update : cups on SL6.x, SL7.x i386/x86_64 (20150617)	Nessus	Scientific Linux Local Security Checks	critical
84258	RHEL 6 / 7 : cups (RHSA-2015:1123)	Nessus	Red Hat Local Security Checks	critical
84257	OracleVM 3.3 : cups (OVMSA-2015-0071)	Nessus	OracleVM Local Security Checks	critical
84256	Oracle Linux 6 / 7 : cups (ELSA-2015-1123)	Nessus	Oracle Linux Local Security Checks	critical
82361	Mandriva Linux Security Advisory : cups (MDVSA-2015:108)	Nessus	Mandriva Local Security Checks	medium
82142	Debian DLA-159-1 : cups security update	Nessus	Debian Local Security Checks	medium
82019	SuSE 11.3 Security Update : cups (SAT Patch Number 10394)	Nessus	SuSE Local Security Checks	medium
81932	Mandriva Linux Security Advisory : cups (MDVSA-2015:049)	Nessus	Mandriva Local Security Checks	medium
81573	Ubuntu 14.04 LTS : CUPS vulnerability (USN-2520-1)	Nessus	Ubuntu Local Security Checks	critical
81562	openSUSE Security Update : cups (openSUSE-2015-182)	Nessus	SuSE Local Security Checks	medium
81526	Debian DSA-3172-1 : cups - security update	Nessus	Debian Local Security Checks	medium
81428	Fedora 20 : cups-1.7.5-12.fc20 (2015-2152)	Nessus	Fedora Local Security Checks	medium
81427	Fedora 21 : cups-1.7.5-15.fc21 (2015-2127)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-9679

critical

Tenable Plugins

high

high

medium

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium