CUPS ippReadIO function buffer overflow
| cups-ippreadio-bo (38190) |  High Risk |
Description:
CUPS (Common UNIX Printing System) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ippReadIO function in cups/ipp.c. By sending specially-crafted textWithLanguage or nameWithLanguage tags in an IPP (Internet Printing Protocol) request, a remote attacker from within the local network could overflow a buffer and execute arbitrary code on the system or cause the service to crash.
Platforms Affected:
- Apple, CUPS 1.3.3
- Apple, Mac OS X 10.4.11
- Apple, Mac OS X 10.5.1
- Apple, Mac OS X Server 10.4.11
- Apple, Mac OS X Server 10.5.1
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Debian, Debian Linux 4.0
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- Novell, OpenSUSE 10.2
- Novell, OpenSUSE 10.3
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 10.1
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux 11 Server
- Turbolinux, Turbolinux 11 Server x64 Ed
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux Multimedia
- Turbolinux, Turbolinux Personal
- Turbolinux, Turbolinux wizpy
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
- Turbolinux, Turbolinux Appliance Server 2.0
Remedy:
Apply the appropriate update for your system. See References.
Consequences:
Gain Access
References:
- Apple Web site, About Security Update 2007-009 at http://docs.info.apple.com/article.html?artnum=307179.
- Apple Web site, About Security Update 2007-009 v1.1 at http://docs.info.apple.com/article.html?artnum=307224.
- BugTraq Mailing List, Mon Dec 17 2007 - 15:47:29 CST, Apple OS X Software Update Remote Command Execution at http://archives.neohapsis.com/archives/bugtraq/2007-12/0217.html.
- CUPS Web site, Common UNIX Printing System at http://www.cups.org/.
- Secunia Research 31/10/2007, CUPS IPP Tags Memory Corruption Vulnerability at http://secunia.com/secunia_research/2007-76/advisory/.
- ASA-2007-476: cups security update (RHSA-2007-1023)
- ASA-2007-498: CUPS security update (RHSA-2007-1022)
- BID-26268: CUPS IPP Tag Handling Remote Buffer Overflow Vulnerability
- CVE-2007-4351: Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted (1) textWithLanguage or (2) nameWithLanguage Internet Printing Protocol (IPP) tag, leading to a stack-based buffer overflow.
- DSA-1407: cupsys -- buffer overflow
- FrSIRT/ADV-2007-3681: CUPS ippReadIO() IPP Tags Handling Memory Corruption Vulnerability
- FrSIRT/ADV-2007-4238: Apple Mac OS X Code Execution and Information Disclosure Vulnerabilities
- FrSIRT/ADV-2008-1934: Cisco Wide Area Application Services CUPS Remote Vulnerability
- GLSA-200711-16: CUPS: Memory corruption
- MDKSA-2007:204: Updated cups packages fix vulnerability
- MDKSA-2007:204-1: Updated cups packages fix vulnerability
- RHSA-2007-1020: Important: cups security and bug fix update
- RHSA-2007-1022: Important: cups security update
- RHSA-2007-1023: Important: cups security update
- SA27233: CUPS IPP Tags Memory Corruption Vulnerability
- SA28136: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
- SA30847: Cisco Wide Area Application Services CUPS IPP Tags Memory Corruption
- SECTRACK ID: 1018879: CUPS Buffer Overflow in ippReadIO() Lets Remote Users Execute Arbitrary Code
- SUSE-SA:2007:058: cups IPP remote buffer overflow
Reported:
Oct 31, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net