Detections
Analytics

Debian DSA-566-1 : cupsys - unsanitised input

low Nessus Plugin ID 15664

Synopsis

The remote Debian host is missing a security-related update.

Description

An information leak has been detected in CUPS, the Common UNIX Printing System, which may lead to the disclosure of sensitive information, such as user names and passwords which are written into log files.

The used patch only eliminates the authentication information in the device URI which is logged in the error_log file. It does not eliminate the URI from the environment and process table, which is why the CUPS developers recommend that system administrators do not code authentication information in device URIs in the first place.

Solution

Upgrade the CUPS package.

For the stable distribution (woody) this problem has been fixed in version 1.1.14-5woody7.

See Also

http://www.debian.org/security/2004/dsa-566

Plugin Details

Severity: Low

ID: 15664

File Name: debian_DSA-566.nasl

Version: 1.21

Type: local

Agent: unix

Published: 11/10/2004

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Low

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:cupsys, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 10/14/2004

Vulnerability Publication Date: 10/4/2004

Reference Information

CVE: CVE-2004-0923

CERT: 557062

DSA: 566