Vulnerability Note VU#810572
CUPS print service is vulnerable to privilege escalation and cross-site scripting
Original Release date: 09 Jun 2015 | Last revised: 10 Jun 2015

Overview
CUPS implements the Internet Printing Protocol (IPP) for UNIX-derived operating systems. Various versions of CUPS are vulnerable to a privilege escalation due to a memory management error.

Description
CWE-911: Improper Update of Reference Count – CVE-2015-1158
An issue with how localized strings are handled in cupsd allows a reference counter to over-decrement when handling certain print job request errors. As a result, an attacker can prematurely free an arbitrary string of global scope, creating a dangling pointer to a repurposed block of memory on the heap. The dangling pointer causes ACL verification to fail when parsing ‘admin/conf’ and ‘admin’ ACLs. The ACL handling failure results in unrestricted access to privileged operations, allowing an unauthenticated remote user to upload a replacement CUPS configuration file and mount further attacks.

This vulnerability was introduced in CUPS 1.2.0, released in 2006. All major versions of CUPS from 1.2 to 2.0 are vulnerable. This vulnerability is exploitable by default and without any special permissions other than the ability to send a print job request.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2015-1159

A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many linux distributions run with the web interface activated; OS X has the web interface deactivated by default.

The CVSS score below is based on CVE-2015-1158.

Impact
CVE-2015-1158 may allow a remote unauthenticated attacker access to privileged operations on the CUPS server. CVE-2015-1159 may allow an attacker to execute arbitrary javascript in a user’s browser.

Solution
Apply an update

A patch addressing these issues has been released for all supported versions of CUPS. For the version 2.0 branch (the latest release), 2.0.3 contains the patch. Affected users are encouraged to update as soon as possible.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAppleAffected06 May 201508 May 2015
FreeBSD ProjectAffected08 May 201510 Jun 2015
openSUSE projectAffected08 May 201510 Jun 2015
SUSE LinuxAffected08 May 201510 Jun 2015
CentOSUnknown08 May 201508 May 2015
Debian GNU/LinuxUnknown08 May 201508 May 2015
DesktopBSDUnknown08 May 201508 May 2015
DragonFly BSD ProjectUnknown08 May 201508 May 2015
EMC CorporationUnknown08 May 201508 May 2015
F5 Networks, Inc.Unknown08 May 201508 May 2015
Fedora ProjectUnknown08 May 201508 May 2015
Gentoo LinuxUnknown08 May 201508 May 2015
Hewlett-Packard CompanyUnknown08 May 201508 May 2015
HitachiUnknown08 May 201508 May 2015
IBM CorporationUnknown08 May 201508 May 2015If you are a vendor and your product is affected, let
us know.View More &raquo

CVSS Metrics (Learn More)

Group
Score
Vector

Base
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal
7.3
E:POC/RL:OF/RC:C

Environmental
5.5
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://www.cups.org/blog.php?L1082+I0+Q
https://www.cups.org/str.php?L4609

Credit
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2015-1158
CVE-2015-1159

Date Public:
08 Jun 2015

Date First Published:
09 Jun 2015

Date Last Updated:
10 Jun 2015

Document Revision:
42

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply