The following issues have been fixed :

  - system-config-printer used an unauthenticated connection     when downloading printer drivers from openprinting.org     (CVE-2011-4405). This update disables the printer driver     download feature.

  - system-config-printer did not properly quote shell meta     characters in SMB server or workgroup names when passing     them to the shell. (CVE-2011-2899)

system-config-printer is a print queue configuration tool with a graphical user interface.

It was found that system-config-printer did not properly sanitize NetBIOS and workgroup names when searching for network printers. A remote attacker could use this flaw to execute arbitrary code with the privileges of the user running system-config-printer. (CVE-2011-2899)

All users of system-config-printer are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-printer must be restarted for this update to take effect.

This update fixes a typo from the previous update :

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

Updated system-config-printer packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

system-config-printer is a print queue configuration tool with a graphical user interface.

It was found that system-config-printer did not properly sanitize NetBIOS and workgroup names when searching for network printers. A remote attacker could use this flaw to execute arbitrary code with the privileges of the user running system-config-printer. (CVE-2011-2899)

All users of system-config-printer are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-printer must be restarted for this update to take effect.

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405).
This update disables the printer driver download feature.

system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899).

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1196 advisory.

  - system-config-printer: possible arbitrary code execution in pysmb.py due to improper escaping of hostnames     (CVE-2011-2899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Add system-config-printer-subprocess-no-shell.patch:
    avoid escaping issues when running commands. Fix     bnc#735322.

  - Add system-config-printer-no-openprinting.patch: this     disables the feature where PPD drivers can be downloaded     from OpenPrinting.org. See discussion in bnc#733542. As     a side-effect, this fixes CVE-2011-4405.

From Red Hat Security Advisory 2011:1196 :

Updated system-config-printer packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

system-config-printer is a print queue configuration tool with a graphical user interface.

It was found that system-config-printer did not properly sanitize NetBIOS and workgroup names when searching for network printers. A remote attacker could use this flaw to execute arbitrary code with the privileges of the user running system-config-printer. (CVE-2011-2899)

All users of system-config-printer are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-printer must be restarted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
57555	SuSE 11.1 Security Update : system-config-printer (SAT Patch Number 5607)	Nessus	SuSE Local Security Checks	1/16/2012	1/19/2021	high
61120	Scientific Linux Security Update : system-config-printer on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
76002	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
55996	CentOS 4 / 5 : system-config-printer (CESA-2011:1196)	Nessus	CentOS Local Security Checks	8/30/2011	1/4/2021	medium
75717	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	high
76001	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
55965	RHEL 4 / 5 : system-config-printer (RHSA-2011:1196)	Nessus	Red Hat Local Security Checks	8/24/2011	4/21/2024	critical
74537	openSUSE Security Update : system-config-printer (openSUSE-2011-89)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	high
75718	openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
68332	Oracle Linux 4 / 5 : system-config-printer (ELSA-2011-1196)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium

Detections

Analytics

Plugins Search

high

medium

high

medium

high

high

critical

high

high

medium