CVE-2015-1158: Critical severity cups libraries vulnerability
The addjob function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPPCREATEJOB or (2) IPPPRINTJOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Other sources
The following flaw was found in CUPS:
Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. They can use this to dismantle ACLs protecting privileged operations, and upload a replacement configuration file, and subsequently run arbitrary code on a target machine.
This bug is exploitable in default configurations, and does not require any special permissions other than the basic ability to print.
Acknowledgements:
Red Hat would like to thank the CERT/CC for reporting this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1158?
CVE-2015-1158 is assigned a medium severity rating due to its potential for data corruption and its impact on the affected systems.
How do I fix CVE-2015-1158?
To fix CVE-2015-1158, upgrade to CUPS version 2.0.3 or later, which addresses the vulnerability.
Which versions of CUPS are affected by CVE-2015-1158?
CVE-2015-1158 affects CUPS versions prior to 2.0.3.
Can CVE-2015-1158 lead to remote code execution?
CVE-2015-1158 does not lead to remote code execution but allows for data corruption through crafted requests.
What types of operations allow exploitation of CVE-2015-1158?
CVE-2015-1158 can be exploited through crafted IPP_CREATE_JOB or IPP_PRINT_JOB requests.