CUPS negative Content-Length memcpy() buffer overflows
| cups-neg-memcpy-bo (10909) |  High Risk |
Description:
The Common Unix Printing System (CUPS) is vulnerable to multiple buffer overflows, caused by improper handling of negative Content-Length calls by memcpy(). By sending a specially-crafted HTTP POST request to the remote CUPS port containing a negative Content-Length header or an HTTP POST request that uses a negative length in chunked-transfer encoding, a remote attacker could overflow a buffer and cause the system to crash or execute arbitrary code on the system with root privileges.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of CUPS (1.1.18 or later), available from the CUPS Web site. See References.
For Apple Mac OS X:
Upgrade to the latest version of Mac OS X (10.2.3 or later), as listed in AppleCare Knowledge Base Document 61798. See References.
For SuSE Linux:
Upgrade to the latest CUPS package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:002 for more information. See References.
SuSE Linux 8.1 (Intel): 1.1.15-69 or later
SuSE Linux 8.0 (Intel): 1.1.12-90 or later
SuSE Linux 7.3 (Intel): 1.1.10-94 or later
SuSE Linux 7.3 (Sparc): 1.1.10-45 or later
SuSE Linux 7.3 (PPC): 1.1.10-81 or later
SuSE Linux 7.2 (Intel): 1.1.6-122 or later
SuSE Linux 7.1 (Intel): 1.1.6-121 or later
SuSE Linux 7.1 (AXP): 1.1.6-40 or later
SuSE Linux 7.1 (PPC): 1.1.6-53 or later
For Red Hat Linux:
Upgrade to the latest CUPS package, as listed below. Refer to RHSA-2002:295-07 for more information. See References.
Red Hat Linux 7.3: cups-1.1.14-15.2 or later
Red Hat Linux 8.0: cups-1.1.17-0.2 or later
For Mandrake Linux:
Upgrade to the latest CUPS package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:001:CUPS for more information. See References.
Mandrake Linux 7.2, 8.0, and 8.1: 1.1.18-1.4mdk or later
Mandrake Linux 8.2 and 9.0: 1.1.18-1.1mdk or later
For Caldera OpenLinux 3.1 and 3.1.1 (Workstation and Server):
Upgrade to the latest cups package (1.1.10-6 or later), as listed in SCO Security Advisory CSSA-2003-004.0. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest version of cupsys (1.1.14-4.4 or later), as listed in DSA-232-2. See References.
For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of cupsys (1.0.4-12.1 or later), as listed in DSA-232-1. See References.
For Conectiva Linux:
Upgrade to the latest cups package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:702 for more information. See References.
Conectiva Linux 7.0: 1.1.14-1U70_4cl or later
Conectiva Linux 8: 1.1.14-2U80_4cl or later
Conectiva Linux 9: 1.1.18-29091U90_1cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- AppleCare Knowledge Base Document 61798: Apple Security Updates.
- Conectiva Linux Security Announcement CLSA-2003:702: cups.
- CUPS Web site: News - Common UNIX Printing System .
- iDEFENSE Security Advisory 12.23.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS).
- SCO Security Advisory CSSA-2003-004.0: Multiple Security Vulnerabilities in the Common Unix.
- BID-6437: CUPS Negative Length HTTP Header Vulnerability
- CVE-2002-1368: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.
- DSA-232: cupsys -- several vulnerabilities
- MDKSA-2003:001: Updated CUPS packages fix multiple vulnerabilities
- MDKSA-2003:024: Updated packages fix multiple vulnerabilities
- RHSA-2002-295: Updated CUPS packages fix various vulnerabilities
- SA7756: CUPS multiple vulnerabilities
- SA7794: Gentoo updates to CUPS
- SA7803: SuSE updates to CUPS
- SA7843: Mandrake updates to CUPS
- SA7858: RedHat updates to CUPS
- SA7907: Debian updates to cupsys
- SA7913: OpenLinux updates to CUPS
- SUSE-SA:2003:002: cups: local and remote privilege escalation
Platforms Affected:
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Conectiva Linux 9.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- Easy Software Products CUPS prior to 1.1.18
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 9.0
- Novell UnitedLinux 1.0
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- SCO Caldera OpenLinux Server 3.1
- SCO Caldera OpenLinux Server 3.1.1
- SCO Caldera OpenLinux Workstation 3.1
- SCO Caldera OpenLinux Workstation 3.1.1
- SuSE Linux Enterprise Server 8
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- SUSE SuSE Linux 8.1
Reported:
Dec 19, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net