The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.

An update of the cups package has been released.

The remote host is affected by the vulnerability described in GLSA-201908-08 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CUPS. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids :

CVE-2018-4180

Dan Bastone of Gotham Digital Science discovered that a local attacker with access to cupsctl could escalate privileges by setting an environment variable.

CVE-2018-4181

Eric Rafaloff and John Dunlap of Gotham Digital Science discovered that a local attacker can perform limited reads of arbitrary files as root by manipulating cupsd.conf.

CVE-2018-6553

Dan Bastone of Gotham Digital Science discovered that an attacker can bypass the AppArmor cupsd sandbox by invoking the dnssd backend using an alternate name that has been hard linked to dnssd.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.5-11+deb8u4.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3713-1 advisory.

    It was discovered that CUPS incorrectly handled certain print jobs with invalid usernames. A remote     attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS, Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2017-18248)

    Dan Bastone discovered that the CUPS dnssd backend incorrectly handled certain environment variables. A     local attacker could possibly use this issue to escalate privileges. (CVE-2018-4180)

    Eric Rafaloff and John Dunlap discovered that CUPS incorrectly handled certain include directives. A local     attacker could possibly use this issue to read arbitrary files. (CVE-2018-4181)

    Dan Bastone discovered that the CUPS AppArmor profile incorrectly confined the dnssd backend. A local     attacker could possibly use this issue to escape confinement. (CVE-2018-6553)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids :

  - CVE-2017-15400     Rory McNamara discovered that an attacker is able to     execute arbitrary commands (with the privilege of the     CUPS daemon) by setting a malicious IPP server with a     crafted PPD file.

  - CVE-2018-4180     Dan Bastone of Gotham Digital Science discovered that a     local attacker with access to cupsctl could escalate     privileges by setting an environment variable. 

  - CVE-2018-4181     Eric Rafaloff and John Dunlap of Gotham Digital Science     discovered that a local attacker can perform limited     reads of arbitrary files as root by manipulating     cupsd.conf.

  - CVE-2018-6553     Dan Bastone of Gotham Digital Science discovered that an     attacker can bypass the AppArmor cupsd sandbox by     invoking the dnssd backend using an alternate name that     has been hard linked to dnssd.

ID	Name	Product	Family	Severity
204396	Photon OS 4.0: Cups PHSA-2023-4.0-0425	Nessus	PhotonOS Local Security Checks	high
127957	GLSA-201908-08 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
111084	Debian DLA-1426-1 : cups security update	Nessus	Debian Local Security Checks	high
111041	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : CUPS vulnerabilities (USN-3713-1)	Nessus	Ubuntu Local Security Checks	high
111014	Debian DSA-4243-1 : cups - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-6553

high

Tenable Plugins

high

high

high

high

high