The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cups: code execution via unescape ANSI escape sequences (CVE-2014-8166)

  - cups: incorrect string reference counting (VU#810572) (CVE-2015-1158)

  - The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which     makes it easier for remote attackers to conduct DNS rebinding attacks. (CVE-2009-0164)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A cross-site scripting flaw was found in the cups web     templating engine. An attacker could use this flaw to     bypass the default configuration settings that bind the     CUPS scheduler to the 'localhost' or loopback     interface.(CVE-2015-1159)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5031)

  - A string reference count bug was found in cupsd,     causing premature freeing of string objects. An     attacker could submit a malicious print job that     exploits this flaw to dismantle ACLs protecting     privileged operations, allowing a replacement     configuration file to be uploaded, which in turn     allowed the attacker to run arbitrary code on the CUPS     server.(CVE-2015-1158)

  - A cross-site scripting (XSS) flaw was found in the CUPS     web interface. An attacker could use this flaw to     perform a cross-site scripting attack against users of     the CUPS web interface.(CVE-2014-2856)

  - A localhost.localdomain whitelist entry in valid_host()     in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by     sending POST requests to the CUPS daemon in conjunction     with DNS rebinding. The localhost.localdomain name is     often resolved via a DNS server (neither the OS nor the     web browser is responsible for ensuring that     localhost.localdomain is 127.0.0.1).(CVE-2017-18190)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5030)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-3537)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the way CUPS handled     compressed raster image files. An attacker could create     a specially crafted image file that, when passed via     the CUPS Raster filter, could cause the CUPS filter to     crash.(CVE-2014-9679)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following issues are fixed by this update :

  - CVE-2012-5519: privilege escalation via cross-site     scripting and bad print job submission used to replace     cupsd.conf on server (bsc#924208).

  - CVE-2015-1158: Improper Update of Reference Count

  - CVE-2015-1159: Cross-Site Scripting

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201510-07 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cups. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

New cups packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

This update fixed 2 security flaws.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream bug-fix release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

Red Hat would like to thank the CERT/CC for reporting CVE-2015-1158 and CVE-2015-1159 issues.

All cups users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

After installing this update, the cupsd daemon will be restarted automatically.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-1158, CVE-2015-1159, CVE-2014-9679 (bug     #1229982).

From Red Hat Security Advisory 2015:1123 :

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems.

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the attacker to run arbitrary code in the CUPS server (CVE-2015-1158)

A cross-site scripting flaw was found in the cups web templating engine. An attacker could use this flaw to bypass the default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. (CVE-2015-1159)

An integer overflow leading to a heap-based buffer overflow was found in the way cups handled compressed raster image files. An attacker could create a specially crafted image file, which when passed via the cups Raster filter, could cause the cups filter to crash.
(CVE-2014-9679)

Red Hat would like to thank the CERT/CC for reporting CVE-2015-1158 and CVE-2015-1159 issues.

All cups users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.

This update fixes the following issues :

  - CVE-2015-1158 and CVE-2015-1159 fixes a possible     privilege escalation via cross-site scripting and bad     print job submission used to replace cupsd.conf on     server (CUPS STR#4609 CERT-VU-810572 CVE-2015-1158     CVE-2015-1159 bugzilla.suse.com bsc#924208). In general     it is crucial to limit access to CUPS to trustworthy     users who do not misuse their permission to submit print     jobs which means to upload arbitrary data onto the CUPS     server, see     https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_setti     ngs and cf. the entries about CVE-2012-5519 below.

According to its banner, the CUPS printer service running on the remote host is a version prior to 2.0.3. It is, therefore, potentially affected by the following vulnerabilities :

  - A privilege escalation vulnerability exists due to a     flaw in cupsd when handling printer job request errors.
    An unauthenticated, remote attacker can exploit this,     with a specially crafted request, to prematurely free an     arbitrary string of global scope, creating a dangling     pointer to a repurposed block of memory on the heap,     resulting ACL verification to fail when parsing     'admin/conf' and 'admin' ACLs. This allows an attacker     to upload a replacement CUPS configuration file.
    (CVE-2015-1158)

  - A cross-site scripting vulnerability exists due to     improper sanitization of user-supplied input to the     'QUERY' parameter of the help page. This allows a remote     attacker, with a specially crafted request, to execute     arbitrary script code. (CVE-2015-1159)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2629-1 advisory.

    It was discovered that CUPS incorrectly handled reference counting when handling localized strings. A     remote attacker could use this issue to escalate permissions, upload a replacement CUPS configuration     file, and execute arbitrary code. (CVE-2015-1158)

    It was discovered that the CUPS templating engine contained a cross-site scripting issue. A remote     attacker could use this issue to bypass default configuration settings. (CVE-2015-1159)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CUPS development team reports :

The new release addresses two security vulnerabilities, add localizations for German and Russian, and includes several general bug fixes. Changes include :

Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159 exploiting the dynamic linker (STR #4609)

Security: The scheduler could hang with malformed gzip data (STR #4602)

It was discovered that CUPS, the Common UNIX Printing System, is vulnerable to a remotely triggerable privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on the CUPS server.

Two critical vulnerabilities have been found in the CUPS printing system :

CVE-2015-1158 - Improper Update of Reference Count Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. They can use this to dismantle ACL&rsquo;s protecting privileged operations, and upload a replacement configuration file, and subsequently run arbitrary code on a target machine.

This bug is exploitable in default configurations, and does not require any special permissions other than the basic ability to print.

CVE-2015-1159 - Cross-Site Scripting A cross-site scripting bug in the CUPS templating engine allows the above bug to be exploited when a user browses the web. This XSS is reachable in the default configuration for Linux instances of CUPS, and allows an attacker to bypass default configuration settings that bind the CUPS scheduler to the &lsquo;localhost&rsquo; or loopback interface.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198649	RHEL 5 : cups (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124935	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1432)	Nessus	Huawei Local Security Checks	high
119966	SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-2)	Nessus	SuSE Local Security Checks	critical
119965	SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-1)	Nessus	SuSE Local Security Checks	critical
86692	GLSA-201510-07 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
84595	Amazon Linux AMI : cups (ALAS-2015-559)	Nessus	Amazon Linux Local Security Checks	critical
84588	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : cups (SSA:2015-188-01)	Nessus	Slackware Local Security Checks	critical
84311	Fedora 21 : cups-1.7.5-17.fc21 (2015-9801)	Nessus	Fedora Local Security Checks	critical
84310	Fedora 22 : cups-2.0.3-1.fc22 (2015-9726)	Nessus	Fedora Local Security Checks	critical
84276	CentOS 6 / 7 : cups (CESA-2015:1123)	Nessus	CentOS Local Security Checks	critical
84259	Scientific Linux Security Update : cups on SL6.x, SL7.x i386/x86_64 (20150617)	Nessus	Scientific Linux Local Security Checks	critical
84258	RHEL 6 / 7 : cups (RHSA-2015:1123)	Nessus	Red Hat Local Security Checks	critical
84257	OracleVM 3.3 : cups (OVMSA-2015-0071)	Nessus	OracleVM Local Security Checks	critical
84256	Oracle Linux 6 / 7 : cups (ELSA-2015-1123)	Nessus	Oracle Linux Local Security Checks	critical
84184	openSUSE Security Update : cups (openSUSE-2015-418)	Nessus	SuSE Local Security Checks	critical
84149	CUPS < 2.0.3 Multiple Vulnerabilities	Nessus	Misc.	critical
84145	SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2015:1041-1)	Nessus	SuSE Local Security Checks	critical
84117	Ubuntu 14.04 LTS : CUPS vulnerabilities (USN-2629-1)	Nessus	Ubuntu Local Security Checks	critical
84070	FreeBSD : cups -- multiple vulnerabilities (a40ec970-0efa-11e5-90e4-d050996490d0)	Nessus	FreeBSD Local Security Checks	critical
84063	Debian DSA-3283-1 : cups - security update	Nessus	Debian Local Security Checks	critical
84061	Debian DLA-239-1 : cups security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-1158

critical

Tenable Plugins

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical