CVE-2014-8166: Input Validation
It was reported that ANSI escape sequences could be added to printer names in CUPS. Becaue CUPS has a browsing feature that, when enabled, allows remote hosts to announce shared printers, a malicious host or user could send a specially-crafted UDP packet to a CUPS server announcing an arbitrary printer name that includes ANSI escape sequences. Since the CUPS daemon does not remove these characters, a user on the targeted system could query the printer list (using 'lpstat -a', for example). If this were done in a terminal that supported the ANSI escape sequences (like a terminal with support for color), then code execution could be possible as the terminal would interpret the ANSI escape sequences contained in the printer name.
Other sources
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8166?
CVE-2014-8166 is classified as a medium severity vulnerability.
How do I fix CVE-2014-8166?
To fix CVE-2014-8166, update CUPS to version 1.6 or later.
What type of systems are affected by CVE-2014-8166?
CVE-2014-8166 affects systems running CUPS versions below 1.6.
How can CVE-2014-8166 be exploited?
CVE-2014-8166 can be exploited by a malicious user sending specially-crafted UDP packets to announce arbitrary printer names.
Is CUPS browsing feature related to CVE-2014-8166?
Yes, the vulnerability is related to the CUPS browsing feature that allows remote hosts to announce shared printers.