Vulnerabilities > CVE-2008-0047 - Buffer Errors vulnerability in Cups 1.3.5

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
apple
cups
CWE-119
critical
nessus

Summary

Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

Vulnerable Configurations

Part Description Count
OS
Apple
2
Application
Cups
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200804-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200804-01 (CUPS: Multiple vulnerabilities) Multiple vulnerabilities have been reported in CUPS: regenrecht (VeriSign iDefense) discovered that the cgiCompileSearch() function used in several CGI scripts in CUPS
    last seen2020-06-01
    modified2020-06-02
    plugin id31752
    published2008-04-04
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31752
    titleGLSA-200804-01 : CUPS: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200804-01.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31752);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:44");
    
      script_cve_id("CVE-2008-0047", "CVE-2008-0053", "CVE-2008-0882", "CVE-2008-1373");
      script_bugtraq_id(27906, 28307, 28334, 28544);
      script_xref(name:"GLSA", value:"200804-01");
    
      script_name(english:"GLSA-200804-01 : CUPS: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200804-01
    (CUPS: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been reported in CUPS:
        regenrecht (VeriSign iDefense) discovered that the
        cgiCompileSearch() function used in several CGI scripts in CUPS'
        administration interface does not correctly calculate boundaries when
        processing a user-provided regular expression, leading to a heap-based
        buffer overflow (CVE-2008-0047).
        Helge Blischke reported a
        double free() vulnerability in the process_browse_data() function when
        adding or removing remote shared printers (CVE-2008-0882).
        Tomas Hoger (Red Hat) reported that the gif_read_lzw() function
        uses the code_size value from GIF images without properly checking it,
        leading to a buffer overflow (CVE-2008-1373).
        An unspecified
        input validation error was discovered in the HP-GL/2 filter
        (CVE-2008-0053).
      
    Impact :
    
        A local attacker could send specially crafted network packets or print
        jobs and possibly execute arbitrary code with the privileges of the
        user running CUPS (usually lp), or cause a Denial of Service. The
        vulnerabilities are exploitable via the network when CUPS is sharing
        printers remotely.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200804-01"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All CUPS users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-print/cups-1.2.12-r7'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(119);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:cups");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/04/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-print/cups", unaffected:make_list("ge 1.2.12-r7"), vulnerable:make_list("lt 1.2.12-r7"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "CUPS");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0192.NASL
    descriptionFrom Red Hat Security Advisory 2008:0192 : Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the
    last seen2020-06-01
    modified2020-06-02
    plugin id67670
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67670
    titleOracle Linux 5 : cups (ELSA-2008-0192)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2008:0192 and 
    # Oracle Linux Security Advisory ELSA-2008-0192 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(67670);
      script_version("1.9");
      script_cvs_date("Date: 2019/10/25 13:36:07");
    
      script_cve_id("CVE-2008-0047", "CVE-2008-0053", "CVE-2008-1373");
      script_bugtraq_id(28307, 28544);
      script_xref(name:"RHSA", value:"2008:0192");
    
      script_name(english:"Oracle Linux 5 : cups (ELSA-2008-0192)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2008:0192 :
    
    Updated cups packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 5.
    
    This update has been rated as having moderate security impact by the
    Red Hat Security Response Team.
    
    The Common UNIX Printing System (CUPS) provides a portable printing
    layer for UNIX(R) operating systems.
    
    A heap buffer overflow flaw was found in a CUPS administration
    interface CGI script. A local attacker able to connect to the IPP port
    (TCP port 631) could send a malicious request causing the script to
    crash or, potentially, execute arbitrary code as the 'lp' user. Please
    note: the default CUPS configuration in Red Hat Enterprise Linux 5
    does not allow remote connections to the IPP TCP port. (CVE-2008-0047)
    
    Red Hat would like to thank 'regenrecht' for reporting this issue.
    
    This issue did not affect the versions of CUPS as shipped with Red Hat
    Enterprise Linux 3 or 4.
    
    Two overflows were discovered in the HP-GL/2-to-PostScript filter. An
    attacker could create a malicious HP-GL/2 file that could possibly
    execute arbitrary code as the 'lp' user if the file is printed.
    (CVE-2008-0053)
    
    A buffer overflow flaw was discovered in the GIF decoding routines
    used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
    An attacker could create a malicious GIF file that could possibly
    execute arbitrary code as the 'lp' user if the file was printed.
    (CVE-2008-1373)
    
    All cups users are advised to upgrade to these updated packages, which
    contain backported patches to resolve these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2008-April/000556.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected cups packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(119);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cups");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cups-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cups-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cups-lpd");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2008/03/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/04/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL5", reference:"cups-1.2.4-11.14.el5_1.6")) flag++;
    if (rpm_check(release:"EL5", reference:"cups-devel-1.2.4-11.14.el5_1.6")) flag++;
    if (rpm_check(release:"EL5", reference:"cups-libs-1.2.4-11.14.el5_1.6")) flag++;
    if (rpm_check(release:"EL5", reference:"cups-lpd-1.2.4-11.14.el5_1.6")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cups / cups-devel / cups-libs / cups-lpd");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20080401_CUPS_ON_SL3_X.NASL
    descriptionSL5 Only: A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the
    last seen2020-06-01
    modified2020-06-02
    plugin id60378
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60378
    titleScientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-2897.NASL
    descriptionThree security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation * A buffer overflow when processing HP-GL/2 files Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31816
    published2008-04-11
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31816
    titleFedora 7 : cups-1.2.12-10.fc7 (2008-2897)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2008-002.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. This update contains several security fixes for a number of programs.
    last seen2020-06-01
    modified2020-06-02
    plugin id31605
    published2008-03-19
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31605
    titleMac OS X Multiple Vulnerabilities (Security Update 2008-002)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-3586.NASL
    description - Fri May 9 2008 Tim Waugh <twaugh at redhat.com> 1:1.3.7-2 - Applied patch to fix CVE-2008-1722 (integer overflow in image filter, bug #441692, STR #2790). - Fri May 2 2008 Tim Waugh <twaugh at redhat.com> - Include the hostname in the charset error (part of bug #441719). - Thu Apr 10 2008 Tim Waugh <twaugh at redhat.com> - Log an error when a client requests a charset other than ASCII or UTF-8. - Thu Apr 3 2008 Tim Waugh <twaugh at redhat.com> - Main package requires exactly-matching libs package. - Wed Apr 2 2008 Tim Waugh <twaugh at redhat.com> 1:1.3.7-1 - 1.3.7. No longer need str2715, str2727, or CVE-2008-0047 patches. - Tue Apr 1 2008 Tim Waugh <twaugh at redhat.com> 1:1.3.6-4 - Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303). - Applied patch to prevent heap-based buffer overflow in CUPS helper program (bug #436153, CVE-2008-0047, STR #2729). - Thu Feb 28 2008 Tim Waugh <twaugh at redhat.com> 1.3.6-3 - Apply upstream fix for Adobe JPEG files (bug #166460, STR #2727). - Sat Feb 23 2008 Tim Waugh <twaugh at redhat.com> 1.3.6-2 - Fix encoding of job-sheets option (bug #433753, STR #2715). - Wed Feb 20 2008 Tim Waugh <twaugh at redhat.com> 1.3.6-1 - 1.3.6. No longer need str2650, str2664, or str2703 patches. - Tue Feb 12 2008 Tim Waugh <twaugh at redhat.com> 1.3.5-3 - Fixed admin.cgi handling of DefaultAuthType (bug #432478, STR #2703). - Mon Jan 21 2008 Tim Waugh <twaugh at redhat.com> 1.3.5-2 - Rebuilt. - Thu Jan 10 2008 Tim Waugh <twaugh at redhat.com> - Apply patch to fix busy looping in the backends (bug #426653, STR #2664). - Wed Jan 9 2008 Tim Waugh <twaugh at redhat.com> - Apply patch to prevent overlong PPD lines from causing failures except in strict mode (bug #405061). Needed for compatibility with older versions of foomatic (e.g. Red Hat Enterprise Linux 3/4). - Applied upstream patch to fix cupsctl --remote-any (bug #421411, STR #2650). - Thu Jan 3 2008 Tim Waugh <twaugh at redhat.com> 1.3.5-1 - 1.3.5. No longer need str2600, CVE-2007-4352,5392,5393 patches. - Efficiency fix for pstoraster (bug #416871). - Fri Nov 30 2007 Tim Waugh <twaugh at redhat.com> - CVE-2007-4045 patch is not necessarily because cupsd_client_t objects are not moved in array operations, only pointers to them. - Tue Nov 27 2007 Tim Waugh <twaugh at redhat.com> - Updated to improved dnssd backend from Till Kamppeter. - Don
    last seen2020-06-01
    modified2020-06-02
    plugin id32207
    published2008-05-11
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/32207
    titleFedora 8 : cups-1.3.7-2.fc8 (2008-3586)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-598-1.NASL
    descriptionIt was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047) It was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0053) It was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0882) It was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31785
    published2008-04-04
    reporterUbuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31785
    titleUbuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-598-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_CUPS-5076.NASL
    descriptionThis update of cups fixes a heap-overflow in cgiCompileSearch() that can be abused to execute arbitrary code remotely. (CVE-2008-0047) This bug can only be exploited if the web-interface (631/TCP) is enabled and the CGI scripts use the affected function.
    last seen2020-06-01
    modified2020-06-02
    plugin id31621
    published2008-03-19
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31621
    titleopenSUSE 10 Security Update : cups (cups-5076)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0192.NASL
    descriptionUpdated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the
    last seen2020-06-01
    modified2020-06-02
    plugin id43677
    published2010-01-06
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43677
    titleCentOS 5 : cups (CESA-2008:0192)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1530.NASL
    descriptionSeveral local/remote vulnerabilities have been discovered in cupsys, the Common Unix Printing System. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0047 Heap-based buffer overflow in CUPS, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions. - CVE-2008-0882 Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly the execution of arbitrary code via crafted packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer.
    last seen2020-06-01
    modified2020-06-02
    plugin id31663
    published2008-03-26
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31663
    titleDebian DSA-1530-1 : cupsys - Several vulnerabilities
  • NASL familyMisc.
    NASL idCUPS_1_3_7.NASL
    descriptionAccording to its banner, the version of CUPS installed on the remote host is affected by several issues : - A buffer overflow exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id31730
    published2008-04-03
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31730
    titleCUPS < 1.3.7 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-3449.NASL
    description - Fri May 9 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-11 - Applied patch to fix CVE-2008-1722 (integer overflow in image filter, bug #441692, STR #2790). - Tue Apr 1 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-10 - Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303). - Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117). - Applied patch to prevent heap-based buffer overflow in CUPS helper program (bug #436153, CVE-2008-0047, STR #2729). - Fri Feb 22 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-9 - Prevent double-free when a browsed class has the same name as a printer or vice versa (CVE-2008-0882, bug #433758, STR #2656). - Mon Nov 12 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-8 - Fixed CVE-2007-4045 patch; has no effect with shipped packages since they are linked with gnutls. - LSPP fixes (cupsdSetString/ClearString). - Wed Nov 7 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-7 - Applied patch to fix CVE-2007-4045 (bug #250161). - Applied patch to fix CVE-2007-4352, CVE-2007-5392 and CVE-2007-5393 (bug #345101). - Thu Nov 1 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-6 - Applied patch to fix CVE-2007-4351 (STR #2561, bug #361661). - Wed Oct 10 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-5 - Use ppdev for parallel port Device ID retrieval (bug #311671). - Thu Aug 9 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-4 - Applied patch to fix CVE-2007-3387 (bug #251518). - Tue Jul 31 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-3 - Better buildroot tag. - Moved LSPP access check and security attributes check in add_job() to before allocation of the job structure (bug #231522). - Mon Jul 23 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-2 - Use kernel support for USB paper-out detection, when available (bug #249213). - Fri Jul 13 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-1 - 1.2.12. No longer need adminutil or str2408 patches. - Wed Jul 4 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.11-3 - Better paper-out detection patch still (bug #246222). - Fri Jun 29 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.11-2 - Applied patch to fix group handling in PPDs (bug #186231, STR #2408). - Wed Jun 27 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.11-1 - Fixed permissions on classes.conf in the file manifest (bug #245748). - 1.2.11. - Tue Jun 12 2007 Tim Waugh <twaugh at redhat.com> - Make the initscript use start priority 56 (bug #213828). - Mon Jun 11 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.10-12 - Better paper-out detection patch (bug #241589). - Mon May 21 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.10-11 - Fixed _cupsAdminSetServerSettings() sharing/shared handling (bug #238057). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id32197
    published2008-05-11
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/32197
    titleFedora 7 : cups-1.2.12-11.fc7 (2008-3449)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0192.NASL
    descriptionUpdated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the
    last seen2020-06-01
    modified2020-06-02
    plugin id31754
    published2008-04-04
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31754
    titleRHEL 5 : cups (RHSA-2008:0192)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2008-094-01.NASL
    descriptionNew cups packages are available for Slackware 12.0, and -current to fix security issues. The change from CUPS 1.2.x to CUPS 1.3.x was tested here, but if you
    last seen2020-06-01
    modified2020-06-02
    plugin id31740
    published2008-04-04
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31740
    titleSlackware 12.0 / current : cups (SSA:2008-094-01)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-2131.NASL
    descriptionTwo security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation This update also fixes a problem with processing some JPEG files. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31814
    published2008-04-11
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31814
    titleFedora 8 : cups-1.3.6-4.fc8 (2008-2131)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-081.NASL
    descriptionA heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047). A validation error in the Hp-GL/2 filter was also discovered (CVE-2008-0053). Finally, a vulnerability in how CUPS handled GIF files was found by Tomas Hoger of Red Hat, similar to previous issues corrected in PHP, gd, tk, netpbm, and SDL_image (CVE-2008-1373). The updated packages have been patched to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id37420
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/37420
    titleMandriva Linux Security Advisory : cups (MDVSA-2008:081)

Oval

accepted2013-04-29T04:01:24.667-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptionHeap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.
familyunix
idoval:org.mitre.oval:def:10085
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleHeap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.
version18

Redhat

advisories
rhsa
idRHSA-2008:0192
rpms
  • cups-1:1.2.4-11.14.el5_1.6
  • cups-debuginfo-1:1.2.4-11.14.el5_1.6
  • cups-devel-1:1.2.4-11.14.el5_1.6
  • cups-libs-1:1.2.4-11.14.el5_1.6
  • cups-lpd-1:1.2.4-11.14.el5_1.6

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 28307 CVE(CAN) ID: CVE-2008-0047 Common Unix Printing System (CUPS)是一款通用Unix打印系统,是Unix环境下的跨平台打印解决方案,基于Internet打印协议,提供大多数PostScript和raster打印机服务。 CUPS的CGI接口处理畸形的用户请求时存在堆缓冲区溢出漏洞,远程攻击者可能利用此漏洞控制服务器。 CUPS在TCP 631端口上监听请求,这个接口允许访问一些用于管理CUPS和提供打印任务信息的CGI应用。如果远程攻击者向这个端口提交了恶意请求的话,就可能触发堆溢出,导致执行任意指令。 如果要远程利用这个漏洞,目标主机必须在网络中共享打印机,否则CUPS仅监听于本地接口,而本地利用这个漏洞只能导致权限提升。 Apple Mac OS X 10.5.2 Apple MacOS X Server 10.5.2 Easy Software Products CUPS 1.3.5 临时解决方法: * 禁止远程共享打印机。 厂商补丁: Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg target=_blank>http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg</a>
idSSV:3058
last seen2017-11-19
modified2008-03-20
published2008-03-20
reporterRoot
titleCUPS CGI接口远程堆溢出漏洞