CVE-2013-6476: Medium severity Canonical Ubuntu Linux vulnerability
It was found that the OPVPWrapper::loadDriver() function in the pdftoopvp filter did not restrict the directory drivers could be loaded from. As the driver name can be configured based on a PPD file, processing a PDF in an attacker-controlled directory containing a malicious driver could lead to arbitrary code execution with the privileges of the "lp" user.
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Other sources
The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cupsto a version that resolves this vulnerability.Fixed in 2.3.3op2-3+deb11u8Fixed in 2.3.3op2-3+deb11u9Fixed in 2.4.2-3+deb12u8Fixed in 2.4.10-2 - Upgrade
Upgrade
debian/cups-filtersto a version that resolves this vulnerability.Fixed in 1.28.7-1+deb11u2Fixed in 1.28.7-1+deb11u3Fixed in 1.28.17-3+deb12u1Fixed in 1.28.17-6 - Upgrade
Upgrade
CUPS / cups-filters pdftoopvp filterto a version that resolves this vulnerability.Fixed in 1.0.47
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6476?
CVE-2013-6476 is considered a moderate severity vulnerability due to the potential for remote code execution from an attacker-controlled directory.
How do I fix CVE-2013-6476?
To fix CVE-2013-6476, upgrade to a patched version of the cups or cups-filters software as listed in the affected software documentation.
Which versions are affected by CVE-2013-6476?
CVE-2013-6476 affects specific versions of cups and cups-filters on Debian and Ubuntu systems, including earlier versions before the patches were released.
What types of systems are affected by CVE-2013-6476?
CVE-2013-6476 affects systems running Debian, Ubuntu, and Fedora that utilize the cups or cups-filters packages.
Is there a workaround for CVE-2013-6476?
A potential workaround for CVE-2013-6476 is to restrict access to the directories where malicious drivers could be placed until a patch can be applied.