USN-7041-1 fixed a vulnerability in CUPS. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: Simone Margaritelli discovered that CUPS incorrectly sanitized IPP data when creating PPD files. A remote attacker could possibly use this issue to manipulate PPD files and execute arbitrary code when a printer is used.
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
A remote attacker who has successfully installed or hijacked an exposed printer (via UPD or mDNS) and was able to return a malicious IPP attribute, the attacker may be able to exploit FoomaticRIPCommandLine to execute arbitrary commands. Due to a lack of sanitization in cfGetPrinterAttributes API and ppdCreatePPDFromIPP2, a vulnerable CUPS system will execute the foomatic-rip filter binary when a print job is sent to the printer.
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.
The sandbox profile dynamically generated by cupsdCreateProfile() unintentionally allows write access to /etc/cups. This can be used by an attacker that has obtained sandboxed root access to alter /etc/cups/cups-files.conf, leading to unsandboxed root code execution.
References:
https://blog.gdssecurity.com/labs/2018/7/11/cups-local-privilege-escalation-and-sandbox-escapes.html
Upstream patch:
https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc
The following flaw was found in CUPS:
Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. They can use this to dismantle ACLs protecting privileged operations, and upload a replacement configuration file, and subsequently run arbitrary code on a target machine.
This bug is exploitable in default configurations, and does not require any special permissions other than the basic ability to print.
Acknowledgements:
Red Hat would like to thank the CERT/CC for reporting this issue.
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
It was discovered that a local user with privileges of group=lp can write symbolic links in the rss directory and use that to gain '@SYSTEM' group privilege with cupsd.
Permissions:
drwxrwxr-x. 2 root lp 4096 Jul 2 09:58 /var/cache/cups/rss
SELinux mitigates this vulnerability
It was reported that ANSI escape sequences could be added to printer names in CUPS. Becaue CUPS has a browsing feature that, when enabled, allows remote hosts to announce shared printers, a malicious host or user could send a specially-crafted UDP packet to a CUPS server announcing an arbitrary printer name that includes ANSI escape sequences. Since the CUPS daemon does not remove these characters, a user on the targeted system could query the printer list (using 'lpstat -a', for example). If this were done in a terminal that supported the ANSI escape sequences (like a terminal with support for color), then code execution could be possible as the terminal would interpret the ANSI escape sequences contained in the printer name.
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.
The gifreadlzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.
GIF image file format readers in various open source projects are based on the GIF decoder implementation written by David Koblas. This implementation contains a bug in the LZW decompressor, causing it to in correctly handle compressed streams that contain code words that were not yet added to the decompression table. LZW decompression has a special case (a KwKwK string) when code word may match the first free entry in the decompression table. The implementation used in this GIF reading code allows code words not only matching, but also exceeding the first free entry.
This problem is identical to a bug found in BSD compress (CVE-2011-2895, bug #727624), but given the unclear relationship between BSD compress and GIF decoder code bases, separate CVE is used here.
Several projects refer to pbmplus as the source form where GIF reading code was taken:
http://www.acme.com/software/pbmplus/
In pbmplus version of the code, the flaw can be found in LWZReadByte():
if (code >= maxcode) { sp++ = firstcode; code = oldcode; }
This allows creating a loop in the decompression table, which leads to an "infinite" loop:
while (code >= clearcode) { sp++ = table[1][code]; if (code == table[0][code]) pmerror("circular table entry BIG ERROR"); code = table[0][code]; }
where:
#define MAXLWZBITS 12 static int table[2][(1<< MAXLWZBITS)]; static int stack[(1<<(MAXLWZBITS))2], sp; sp = stack;
This results in stack[] buffer overflow. If table[][] is located above stack[], stack[] overflow may further modify decoding table and break infinite loop.
The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVEGSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTPUNAUTHORIZED responses.
Quoting from the upstream bug report http://cups.org/str.php?L3510:
directory that is writable by unprivileged processes.
This is a latent privilege escalation vulnerability. It can be exploited only in the presence of other CUPS vulnerabilities.
Why this is privilege escalation --------------------------------
This is privilege escalation, because an unprivileged process can trick the CUPS server into overwriting arbitrary files as root.
Example:
drwxrwxr-x 4 root lp /var/cache/cups -rw-r----- 1 root lp /var/cache/cups/remote.cache
This file is opened with cupsFileOpen() which simply opens the file with open(filename, OWRONLY | OTRUNC | OCREAT | OLARGEFILE | OBINARY, 0666).
If a CUPS "external" program has a vulnerability, an attacker can use the group=lp privileges to replace /var/cache/cups/remote.cache with a symlink to a root-writable file. CUPS will then overwrite that file as root. A similar latent vulnerability exists for the state file /var/cache/cups/job.cache.
Why this is a latent vulnerability ----------------------------------
This is a latent vulnerability, because there is no known exploit for CUPS "external" programs that run as user=lp, group=lp.
The upstream fix looks more like a preventative fix as there does not seem to be anything exploitable here, so this looks like more a hardening than a response to an actual flaw.
The cgiinitializestring function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.
A NULL pointer dereference issue exists in the WriteProlog function of the texttops image filter. The return value from calloc is not checked. This may lead to a NULL pointer dereference. Since the offset from the pointer at which data is subsequently written is controlled by the user, this issue may lead to application termination or arbitrary code execution.
Several cross-site scripting (XSS) flaws were found in the way CUPS web server interface used to process HTML form(s) content. A remote attacker could provide a specially-crafted HTML page(s), which once visited, by a local, unsuspecting user could lead to intended client-side security mechanisms bypass or, potentially, to injecting of malicious scripts into web pages, processed by CUPS web interface.
Acknowledgements:
Red Hat would like to thank Aaron Sigel of Apple Product Security for responsibly reporting this issue.
Anibal Sacco from Core Security Technologies discovered a NULL pointer dereference flaw in CUPS daemon when handling the IPPTAGUNSUPPORTED, which allows remote attackers with access to CUPS' IPP port to crash cupsd.
Acknowledgements:
Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue.
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.
Swen van Brussel reported pointer use-after-delete flaw, present in the CUPS directory services routine, processing new data about available printers and printer classes. A remote attacker could suspend, and after a carefully-chosen time interval renew sending of CUPS browse packets to the victim machine with running cupsd daemon, leading to a denial of service (cupsd daemon stop or crash).
Acknowledgements:
Red Hat would like to thank Swen van Brussel for reporting this issue.
Swen van Brussel reported pointer use-after-delete flaw, present in the CUPS directory services routine, processing new data about available printers and printer classes. A remote attacker could suspend, and after a carefully-chosen time interval renew sending of CUPS browse packets to the victim machine with running cupsd daemon, leading to a denial of service (cupsd daemon stop or crash).
Acknowledgements:
Red Hat would like to thank Swen van Brussel for reporting this issue.
An infinite loop flaw was found in xpdf's JBIG2 MMR decoder. If a carefully crafted PDF file is opened, it could cause xpdf to stop responding.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.
Multiple buffer overflow flaws were found in xpdf's JBIG2 MMR decoder. A carefully crafted PDF file could result in arbitrary code execute with the permissions of the user running xpdf.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting these flaws.
Multiple NULL derefernce flaws were found in xpdf's JBIG2 decoder. A carefully crafted PDF file could cause xpdf to crash when opened.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting these flaws.
An invalid free() flaw was found in xpdf's JBIG2 decoder. If a malicious PDF file could free() attacker controlled data, it may be possible to execute arbitrary code with the permissions of the user running xpdf.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.
An integer overflow flaw was found in xpdf's JBIG2 decoder. This flaw could result in arbitrary code execute with the permissions of the user running xpdf.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.
pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.