CVE-2010-2431: Low severity cups vulnerability

Quoting from the upstream bug report http://cups.org/str.php?L3510:

directory that is writable by unprivileged processes.

This is a latent privilege escalation vulnerability. It can be exploited only in the presence of other CUPS vulnerabilities.

Why this is privilege escalation --------------------------------

This is privilege escalation, because an unprivileged process can trick the CUPS server into overwriting arbitrary files as root.

Example:

drwxrwxr-x 4 root lp /var/cache/cups -rw-r----- 1 root lp /var/cache/cups/remote.cache

This file is opened with cupsFileOpen() which simply opens the file with open(filename, OWRONLY | OTRUNC | OCREAT | OLARGEFILE | OBINARY, 0666).

If a CUPS "external" program has a vulnerability, an attacker can use the group=lp privileges to replace /var/cache/cups/remote.cache with a symlink to a root-writable file. CUPS will then overwrite that file as root. A similar latent vulnerability exists for the state file /var/cache/cups/job.cache.

Why this is a latent vulnerability ----------------------------------

This is a latent vulnerability, because there is no known exploit for CUPS "external" programs that run as user=lp, group=lp.

The upstream fix looks more like a preventative fix as there does not seem to be anything exploitable here, so this looks like more a hardening than a response to an actual flaw.