CUPS strncat() options buffer overflow
| cups-strncat-options-bo (10910) |  High Risk |
Description:
The Common Unix Printing System (CUPS) is vulnerable to a buffer overflow, caused by improper bounds checking of the options string by the strncat() function. By sending a print job with an overly long "options" string, a remote or local attacker could overflow a buffer and execute arbitrary code on the system with root privileges.
Platforms Affected:
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- Conectiva, Linux 9.0
- Debian, Debian Linux 2.0
- Debian, Debian Linux 2.2
- Debian, Debian Linux 3.0
- Easy Software Products, CUPS prior to 1.1.18
- MandrakeSoft, Mandrake Linux 7.2
- MandrakeSoft, Mandrake Linux 8.0
- MandrakeSoft, Mandrake Linux 8.0 PPC
- MandrakeSoft, Mandrake Linux 8.1 IA64
- MandrakeSoft, Mandrake Linux 8.1
- MandrakeSoft, Mandrake Linux 8.2
- MandrakeSoft, Mandrake Linux 8.2 PPC
- MandrakeSoft, Mandrake Linux 9.0
- Novell, UnitedLinux 1.0
- RedHat, Linux 7.3
- RedHat, Linux 8.0
- SCO, Caldera OpenLinux Server 3.1
- SCO, Caldera OpenLinux Server 3.1.1
- SCO, Caldera OpenLinux Workstation 3.1
- SCO, Caldera OpenLinux Workstation 3.1.1
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 7.1
- SuSE, SuSE Linux 7.2
- SuSE, SuSE Linux 7.3
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.1
Remedy:
Upgrade to the latest version of CUPS (1.1.18 or later), available from the CUPS Web site. See References.
For Apple Mac OS X:
Upgrade to the latest version of Mac OS X (10.2.3 or later), as listed in AppleCare Knowledge Base Document 61798. See References.
For SuSE Linux:
Upgrade to the latest CUPS package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:002 for more information. See References.
SuSE Linux 8.1 (Intel): 1.1.15-69 or later
SuSE Linux 8.0 (Intel): 1.1.12-90 or later
SuSE Linux 7.3 (Intel): 1.1.10-94 or later
SuSE Linux 7.3 (Sparc): 1.1.10-45 or later
SuSE Linux 7.3 (PPC): 1.1.10-81 or later
SuSE Linux 7.2 (Intel): 1.1.6-122 or later
SuSE Linux 7.1 (Intel): 1.1.6-121 or later
SuSE Linux 7.1 (AXP): 1.1.6-40 or later
SuSE Linux 7.1 (PPC): 1.1.6-53 or later
For Red Hat Linux:
Upgrade to the latest CUPS package, as listed below. Refer to Red Hat Linux Security Advisory RHSA-2002:295-07 for more information. See References.
Red Hat Linux 7.3: cups-1.1.14-15.2 or later
Red Hat Linux 8.0: cups-1.1.17-0.2 or later
For Mandrake Linux:
Upgrade to the latest CUPS package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:001:CUPS for more information. See References.
Mandrake Linux 7.2, 8.0, and 8.1: 1.1.18-1.4mdk or later
Mandrake Linux 8.2 and 9.0: 1.1.18-1.1mdk or later
Upgrade to the latest cups package (1.1.10-6 or later), as listed in SCO Security Advisory CSSA-2003-004.0. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest version of cupsys (1.1.14-4.4 or later), as listed in DSA-232-2. See References.
For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of cupsys (1.0.4-12.1 or later), as listed in DSA-232-1. See References.
For Conectiva Linux:
Upgrade to the latest cups package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:702 for more information. See References.
Conectiva Linux 7.0: 1.1.14-1U70_4cl or later
Conectiva Linux 8: 1.1.14-2U80_4cl or later
Conectiva Linux 9: 1.1.18-29091U90_1cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Privileges
References:
- AppleCare Knowledge Base Document 61798, Apple Security Updates at http://docs.info.apple.com/article.html?artnum=61798.
- Conectiva Linux Security Announcement CLSA-2003:702, cups at http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000702.
- CUPS Web site, News - Common UNIX Printing System at http://www.cups.org/news.php?V87.
- iDEFENSE Security Advisory 12.23.02, Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=30.
- SCO Security Advisory CSSA-2003-004.0, Multiple Security Vulnerabilities in the Common Unix at ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-004.0.txt.
- BID-6438: CUPS strncat() Function Call Buffer Overflow Vulnerability
- CVE-2002-1369: jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
- DSA-232: cupsys -- several vulnerabilities
- MDKSA-2003:001: Updated CUPS packages fix multiple vulnerabilities
- MDKSA-2003:024: Updated packages fix multiple vulnerabilities
- RHSA-2002-295: Updated CUPS packages fix various vulnerabilities
- SUSE-SA:2003:002: cups: local and remote privilege escalation
Reported:
Dec 19, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net