Vulnerabilities > CVE-2010-0540 - Cross-Site Request Forgery (CSRF) vulnerability in Apple mac OS X and mac OS X Server

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2176. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(52484);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2008-5183", "CVE-2009-3553", "CVE-2010-0540", "CVE-2010-0542", "CVE-2010-1748", "CVE-2010-2431", "CVE-2010-2432", "CVE-2010-2941");
  script_bugtraq_id(32419, 37048, 40889, 40897, 40943, 41126, 41131, 44530);
  script_xref(name:"DSA", value:"2176");

  script_name(english:"Debian DSA-2176-1 : cups - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been discovered in the Common UNIX
Printing System :

  - CVE-2008-5183
    A NULL pointer dereference in RSS job completion
    notifications could lead to denial of service.

  - CVE-2009-3553
    It was discovered that incorrect file descriptor
    handling could lead to denial of service.

  - CVE-2010-0540
    A cross-site request forgery vulnerability was
    discovered in the web interface.

  - CVE-2010-0542
    Incorrect memory management in the filter subsystem
    could lead to denial of service.

  - CVE-2010-1748
    Information disclosure in the web interface.

  - CVE-2010-2431
    Emmanuel Bouillon discovered a symlink vulnerability in
    handling of cache files.

  - CVE-2010-2432
    Denial of service in the authentication code.

  - CVE-2010-2941
    Incorrect memory management in the IPP code could lead
    to denial of service or the execution of arbitrary code."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-5183"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-3553"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-0540"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-0542"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-1748"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-2431"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-2432"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-2941"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2011/dsa-2176"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the cups packages.

For the oldstable distribution (lenny), this problem has been fixed in
version 1.3.8-1+lenny9.

The stable distribution (squeeze) and the unstable distribution (sid)
had already been fixed prior to the initial Squeeze release."
  );
  script_set_cvss_base_vector("CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:cups");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/03/02");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"5.0", prefix:"cups", reference:"1.3.8-1+lenny9")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(47683);
  script_version("1.12");
  script_cvs_date("Date: 2018/07/06 11:26:07");

  script_cve_id(
    "CVE-2010-0302",
    "CVE-2010-0540",
    "CVE-2010-0542",
    "CVE-2010-1748",
    "CVE-2010-2431",
    "CVE-2010-2432"
  );
  script_bugtraq_id(38510, 40889, 40897, 40943, 41126, 41131);
  script_xref(name:"Secunia", value:"40165");

  script_name(english:"CUPS < 1.4.4 Multiple Vulnerabilities");
  script_summary(english:"Checks CUPS server version");

  script_set_attribute(attribute:"synopsis", value:"The remote printer service is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of CUPS installed on the remote
host is earlier than 1.4.4. Such versions are affected by several
vulnerabilities :

  - The patch for STR #3200 / CVE-2009-3553 was not
    complete. A remote client can cause a denial of service
    by causing the CUPS server to reference an already
    freed resource. (STR #3490) (CVE-2010-0302)

  - The CUPS daemon may be vulnerable to certain cross-site
    request forgery (CSRF) attacks, e.g., malicious IFRAME
    attacks. (STR #3498) (CVE-2010-0540)

  - An unprivileged process may be able to cause the CUPS
    server to overwrite arbitrary files as the root user.
    (STR #3510) (CVE-2010-2431)

  - The CUPS daemon is vulnerable to a heap corruption
    attack as the 'textops' filter does not verify the
    results of memory allocations. It is possible this
    may lead to arbitrary code execution. (STR #3516)
    (CVE-2010-0542)

  - The CUPS daemon is vulnerable to a denial of service
    attack if compiled without HAVE_GSSAPI. (STR #3518)
    (CVE-2010-2432)

  - The CUPS daemon is vulnerable to an information
    disclosure attack as an attacker can view portions of
    uninitialized memory by a specially crafted URL.
    (STR #3577) (CVE-2010-1748)");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3490");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3498");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3510");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3516");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3518");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/str.php?L3577");
  script_set_attribute(attribute:"see_also", value:"http://www.cups.org/articles.php?L596");
  script_set_attribute(attribute:"solution", value:"Upgrade to CUPS version 1.4.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/02/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/06/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/07/08");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:cups");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("http_version.nasl", "cups_1_3_5.nasl");
  script_require_keys("www/cups", "Settings/ParanoidReport");
  script_require_ports("Services/www", 631);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_http_port(default:631, embedded:TRUE);
get_kb_item_or_exit("www/"+port+"/cups/running");

version = get_kb_item_or_exit("cups/"+port+"/version");
source  = get_kb_item_or_exit("cups/"+port+"/source");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

if (
  version =~ "^1\.([0-3]|4\.[0-3])($|[^0-9])" ||
  version =~ "^1\.4(rc|b)"
)
{
  set_kb_item(name:'www/'+port+'/XSRF', value:TRUE);
  if (report_verbosity > 0)
  {
    report = '\n  Version source    : ' + source +
             '\n  Installed version : ' + version +
             '\n  Fixed version     : 1.4.4\n';

    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else if (version =~ "^(1|1\.4)($|[^0-9.])") audit(AUDIT_VER_NOT_GRANULAR, "CUPS", port, version);
else audit(AUDIT_LISTEN_NOT_VULN, "CUPS", port, version);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2010:0490. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(47044);
  script_version ("1.26");
  script_cvs_date("Date: 2019/10/25 13:36:15");

  script_cve_id("CVE-2010-0540", "CVE-2010-0542", "CVE-2010-1748");
  script_bugtraq_id(40889, 40897);
  script_xref(name:"RHSA", value:"2010:0490");

  script_name(english:"RHEL 3 / 4 / 5 : cups (RHSA-2010:0490)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated cups packages that fix three security issues are now available
for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing
layer for UNIX operating systems. The CUPS 'texttops' filter converts
text files to PostScript.

A missing memory allocation failure check flaw, leading to a NULL
pointer dereference, was found in the CUPS 'texttops' filter. An
attacker could create a malicious text file that would cause
'texttops' to crash or, potentially, execute arbitrary code as the
'lp' user if the file was printed. (CVE-2010-0542)

A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web
interface. If a remote attacker could trick a user, who is logged into
the CUPS web interface as an administrator, into visiting a specially
crafted website, the attacker could reconfigure and disable CUPS, and
gain access to print jobs and system files. (CVE-2010-0540)

Note: As a result of the fix for CVE-2010-0540, cookies must now be
enabled in your web browser to use the CUPS web interface.

An uninitialized memory read issue was found in the CUPS web
interface. If an attacker had access to the CUPS web interface, they
could use a specially crafted URL to leverage this flaw to read a
limited amount of memory from the cupsd process, possibly obtaining
sensitive information. (CVE-2010-1748)

Red Hat would like to thank the Apple Product Security team for
responsibly reporting these issues. Upstream acknowledges regenrecht
as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of
GNUCITIZEN and Tim Starling as the original reporters of
CVE-2010-0540; and Luca Carettoni as the original reporter of
CVE-2010-1748.

Users of cups are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing
this update, the cupsd daemon will be restarted automatically."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2010-0540"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2010-0542"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2010-1748"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2010:0490"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cups");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cups-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cups-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cups-lpd");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4.8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/06/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/18");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^(3|4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x / 4.x / 5.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2010:0490";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL3", reference:"cups-1.1.17-13.3.65")) flag++;

  if (rpm_check(release:"RHEL3", reference:"cups-devel-1.1.17-13.3.65")) flag++;

  if (rpm_check(release:"RHEL3", reference:"cups-libs-1.1.17-13.3.65")) flag++;


  if (rpm_check(release:"RHEL4", reference:"cups-1.1.22-0.rc1.9.32.el4_8.6")) flag++;

  if (rpm_check(release:"RHEL4", reference:"cups-devel-1.1.22-0.rc1.9.32.el4_8.6")) flag++;

  if (rpm_check(release:"RHEL4", reference:"cups-libs-1.1.22-0.rc1.9.32.el4_8.6")) flag++;


  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"cups-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"cups-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"cups-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", reference:"cups-devel-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", reference:"cups-libs-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"cups-lpd-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"cups-lpd-1.3.7-18.el5_5.4")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"cups-lpd-1.3.7-18.el5_5.4")) flag++;


  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cups / cups-devel / cups-libs / cups-lpd");
  }
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57172);
  script_version ("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:43");

  script_cve_id("CVE-2010-0540", "CVE-2010-2431", "CVE-2011-2896", "CVE-2011-3170");

  script_name(english:"SuSE 10 Security Update : CUPS (ZYPP Patch Number 7775)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update fixes the following security issues :

  - 601830: CSRF via admin web interface. (CVE-2010-0540)

  - 680210: users in group 'lp' can overwrite arbitrary
    files. (CVE-2010-2431)

  - 711490: heap overflow in gif decoder. (CVE-2011-2896)

  - 715643: heap overflow in gif decoder (CVE-2011-3170)
    This update also fixes the following non-security 
issues :

  - 671735: CUPS backends do not clear messages like
    'Waiting for printer to finish...'"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2010-0540.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2010-2431.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2011-2896.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2011-3170.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 7775.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/09/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:4, reference:"cups-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"cups-client-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"cups-devel-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"cups-libs-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"cups-libs-32bit-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"cups-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"cups-client-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"cups-devel-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"cups-libs-1.1.23-40.62.1")) flag++;
if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"cups-libs-32bit-1.1.23-40.62.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-952-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(47108);
  script_version("1.11");
  script_cvs_date("Date: 2019/09/19 12:54:26");

  script_cve_id("CVE-2010-0540", "CVE-2010-0542", "CVE-2010-1748");
  script_bugtraq_id(40889, 40897, 40943);
  script_xref(name:"USN", value:"952-1");

  script_name(english:"Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : cups, cupsys vulnerabilities (USN-952-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Adrian Pastor and Tim Starling discovered that the CUPS web interface
incorrectly protected against cross-site request forgery (CSRF)
attacks. If an authenticated user were tricked into visiting a
malicious website while logged into CUPS, a remote attacker could
modify the CUPS configuration and possibly steal confidential data.
(CVE-2010-0540)

It was discovered that CUPS did not properly handle memory allocations
in the texttops filter. If a user or automated system were tricked
into printing a crafted text file, a remote attacker could cause a
denial of service or possibly execute arbitrary code with privileges
of the CUPS user (lp). (CVE-2010-0542)

Luca Carettoni discovered that the CUPS web interface incorrectly
handled form variables. A remote attacker who had access to the CUPS
web interface could use this flaw to read a limited amount of memory
from the cupsd process and possibly obtain confidential data.
(CVE-2010-1748).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/952-1/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups-bsd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups-dbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cups-ppdc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsddk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsys");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsys-bsd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsys-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsys-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:cupsys-dbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcups2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcups2-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupscgi1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupscgi1-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsdriver1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsdriver1-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsimage2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsimage2-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsmime1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsmime1-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsppdc1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsppdc1-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsys2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsys2-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libcupsys2-gnutls10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:8.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:9.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:9.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/06/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/22");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(6\.06|8\.04|9\.04|9\.10|10\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06 / 8.04 / 9.04 / 9.10 / 10.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"6.06", pkgname:"cupsys", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"cupsys-bsd", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"cupsys-client", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"libcupsimage2", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"libcupsimage2-dev", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"libcupsys2", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"libcupsys2-dev", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"libcupsys2-gnutls10", pkgver:"1.2.2-0ubuntu0.6.06.19")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"cupsys", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"cupsys-bsd", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"cupsys-client", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"cupsys-common", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"libcupsimage2", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"libcupsimage2-dev", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"libcupsys2", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"libcupsys2-dev", pkgver:"1.3.7-1ubuntu3.11")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cups", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cups-bsd", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cups-client", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cups-common", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cups-dbg", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cupsys", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cupsys-bsd", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cupsys-client", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cupsys-common", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"cupsys-dbg", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcups2", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcups2-dev", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcupsimage2", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcupsimage2-dev", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcupsys2", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libcupsys2-dev", pkgver:"1.3.9-17ubuntu3.9")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups-bsd", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups-client", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups-common", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups-dbg", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cups-ppdc", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsddk", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsys", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsys-bsd", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsys-client", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsys-common", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"cupsys-dbg", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcups2", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcups2-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupscgi1", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupscgi1-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsdriver1", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsdriver1-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsimage2", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsimage2-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsmime1", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsmime1-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsppdc1", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libcupsppdc1-dev", pkgver:"1.4.1-5ubuntu2.6")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups-bsd", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups-client", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups-common", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups-dbg", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cups-ppdc", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsddk", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsys", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsys-bsd", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsys-client", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsys-common", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"cupsys-dbg", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcups2", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcups2-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupscgi1", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupscgi1-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsdriver1", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsdriver1-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsimage2", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsimage2-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsmime1", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsmime1-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsppdc1", pkgver:"1.4.3-1ubuntu1.2")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libcupsppdc1-dev", pkgver:"1.4.3-1ubuntu1.2")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cups / cups-bsd / cups-client / cups-common / cups-dbg / cups-ppdc / etc");
}