セキュリティの問題を修正する新しい cups パッケージが、Slackware 13.1 と最新版で利用可能です。

New upstream release fixing several security issues: CVE-2010-0540, CVE-2010-0542, CVE-2010-1748.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - 601830: CSRF via admin web interface. (CVE-2010-0540)

  - 680210: users in group 'lp' can overwrite arbitrary     files. (CVE-2010-2431)

  - 711490: heap overflow in gif decoder. (CVE-2011-2896)

  - 715643: heap overflow in gif decoder (CVE-2011-3170)     This update also fixes the following non-security issues :

  - 671735: CUPS backends do not clear messages like     'Waiting for printer to finish...'

According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.4. Such versions are affected by several vulnerabilities :

  - The patch for STR #3200 / CVE-2009-3553 was not     complete. A remote client can cause a denial of service     by causing the CUPS server to reference an already     freed resource. (STR #3490) (CVE-2010-0302)

  - The CUPS daemon may be vulnerable to certain cross-site     request forgery (CSRF) attacks, e.g., malicious IFRAME     attacks. (STR #3498) (CVE-2010-0540)

  - An unprivileged process may be able to cause the CUPS     server to overwrite arbitrary files as the root user.
    (STR #3510) (CVE-2010-2431)

  - The CUPS daemon is vulnerable to a heap corruption     attack as the 'textops' filter does not verify the     results of memory allocations. It is possible this     may lead to arbitrary code execution. (STR #3516)     (CVE-2010-0542)

  - The CUPS daemon is vulnerable to a denial of service     attack if compiled without HAVE_GSSAPI. (STR #3518)     (CVE-2010-2432)

  - The CUPS daemon is vulnerable to an information     disclosure attack as an attacker can view portions of     uninitialized memory by a specially crafted URL.
    (STR #3577) (CVE-2010-1748)

Multiple vulnerabilities were discovered and corrected in cups :

Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540).

The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file (CVE-2010-0542).

The web interface in CUPS, reads uninitialized memory during handling of form variables, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via unspecified vectors (CVE-2010-1748).

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file (CVE-2010-2431).

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in the Common UNIX Printing System :

  - CVE-2008-5183     A NULL pointer dereference in RSS job completion     notifications could lead to denial of service.

  - CVE-2009-3553     It was discovered that incorrect file descriptor     handling could lead to denial of service.

  - CVE-2010-0540     A cross-site request forgery vulnerability was     discovered in the web interface.

  - CVE-2010-0542     Incorrect memory management in the filter subsystem     could lead to denial of service.

  - CVE-2010-1748     Information disclosure in the web interface.

  - CVE-2010-2431     Emmanuel Bouillon discovered a symlink vulnerability in     handling of cache files.

  - CVE-2010-2432     Denial of service in the authentication code.

  - CVE-2010-2941     Incorrect memory management in the IPP code could lead     to denial of service or the execution of arbitrary code.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running CUPS, an open source print server. 

Versions of CUPS earlier than 1.4.4 are potentially affected by multiple vulnerabilities.

  - The texttops filter does not check the results of memory allocations. (STR #3715)

  - A use-after-free vulnerability in the abstract file-descriptor handling interface.  Note that this is related to an incomplete patch for CVE-2009-3553. (STR #3490)

  - In certain instances, the web interface can disclose the contents of memory. (STR #3577)

  - CUPS can overwrite files as root in directories not owned or writeable by non-root users. (STR #3510)

  - An infinite loop can occur when CUPS is not compiled with HAVE_GSSAPI. (STR #3518)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
54882	Slackware 13.1/最新版：cups（SSA:2010-176-05）	Nessus	Slackware Local Security Checks	2011/5/28	2021/1/14	medium
47206	Fedora 11 : cups-1.4.4-4.fc11 (2010-10066)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
56603	SuSE 10 Security Update : CUPS (ZYPP Patch Number 7774)	Nessus	SuSE Local Security Checks	2011/10/24	2021/1/19	medium
47683	CUPS < 1.4.4 Multiple Vulnerabilities	Nessus	Misc.	2010/7/8	2018/7/6	high
47835	Fedora 12 : cups-1.4.4-5.fc12 (2010-10101)	Nessus	Fedora Local Security Checks	2010/7/27	2021/1/11	medium
50606	Mandriva Linux Security Advisory : cups (MDVSA-2010:232)	Nessus	Mandriva Local Security Checks	2010/11/16	2021/1/6	high
52484	Debian DSA-2176-1 : cups - several vulnerabilities	Nessus	Debian Local Security Checks	2011/3/2	2021/1/4	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2010/6/15	2019/3/6	critical
5574	CUPS < 1.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2010/6/18	2019/3/6	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	2010/6/15		high

検出

プラグインの検索

medium

medium

medium

high

medium

high

high

critical

medium

high