CVE-2014-2707: OS Command Injection
cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."
Other sources
cups-browsed is daemon which browses the Bonjour broadcasts of shared, remote CUPS printers and makes the printers available locally. Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands.
Original report: http://seclists.org/oss-sec/2014/q2/3
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cups-filtersto a version that resolves this vulnerability.Fixed in 1.0.51
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2707?
CVE-2014-2707 has a high severity rating due to its ability to allow remote IPP printers to execute arbitrary commands.
How do I fix CVE-2014-2707?
To fix CVE-2014-2707, upgrade the cups-filters package to version 1.0.51 or later.
Which versions of cups-filters are affected by CVE-2014-2707?
CVE-2014-2707 affects cups-filters versions from 1.0.41 to 1.0.50.
What is the impact of CVE-2014-2707?
The impact of CVE-2014-2707 is the potential execution of arbitrary commands on the system, which poses a significant security risk.
Who is responsible for releasing a patch for CVE-2014-2707?
The Linux Foundation is responsible for releasing updates to the cups-filters package that address CVE-2014-2707.