REDHAT-BUG-1607282: Medium severity Apple CUPS vulnerability

Published Jul 23, 2018

Updated

Affected versions of CUPS allow for the SetEnv and PassEnv directives to be specified in the cupsd.conf file, which is editable by non-root users using the cupsctl binary. This allows attacker-controlled environment variables to be passed to CUPS backends, some of which are run as root. By passing malicious values in environment variables to affected backends, it is possible to execute an attacker-supplied binary as root, subject to sandbox restrictions.

References:

https://blog.gdssecurity.com/labs/2018/7/11/cups-local-privilege-escalation-and-sandbox-escapes.html

Upstream patch:

https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc

Affected Software

1 affected component

Apple CUPS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch d47f6aec436e0e9df6554436e391471097686ecc

Event History

Jul 23, 2018

Data Sourced

via Red Hat·08:05 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A non-root user who can use cupsctl to edit cupsd.conf can specify SetEnv or PassEnv directives. The attacker can then supply environment-variable values to CUPS backends.

When does this lead to root-level code execution?

The affected environment variables must be passed to a CUPS backend that runs as root, and the attacker must be able to use malicious values to cause execution of an attacker-supplied binary. Sandbox restrictions may limit exploitation.

How can administrators identify potentially affected configurations?

Review cupsd.conf for SetEnv and PassEnv directives and determine whether non-root users can modify those settings through cupsctl. Also identify CUPS backends that run as root and could receive attacker-controlled environment variables.

REDHAT-BUG-1607282: Medium severity Apple CUPS vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

When does this lead to root-level code execution?

How can administrators identify potentially affected configurations?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does this lead to root-level code execution?

How can administrators identify potentially affected configurations?