Debian Security Advisory

DSA-232-1 cupsys -- several vulnerabilities

Date Reported:

20 Jan 2003

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 6475, BugTraq ID 6440, BugTraq ID 6439, BugTraq ID 6438, BugTraq ID 6437, BugTraq ID 6436, BugTraq ID 6435.
In Mitre's CVE dictionary: CVE-2002-1366, CVE-2002-1367, CVE-2002-1368, CVE-2002-1369, CVE-2002-1371, CVE-2002-1372, CVE-2002-1383, CVE-2002-1384.

More information:

Multiple vulnerabilities were discovered in the Common Unix Printing System (CUPS). Several of these issues represent the potential for a remote compromise or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:

CAN-2002-1383: Multiple integer overflows allow a remote attacker to execute arbitrary code via the CUPSd HTTP interface and the image handling code in CUPS filters.
CAN-2002-1366: Race conditions in connection with /etc/cups/certs/ allow local users with lp privileges to create or overwrite arbitrary files. This is not present in the potato version.
CAN-2002-1367: This vulnerability allows a remote attacker to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page.
CAN-2002-1368: Negative lengths fed into memcpy() can cause a denial of service and possibly execute arbitrary code.
CAN-2002-1369: An unsafe strncat() function call processing the options string allows a remote attacker to execute arbitrary code via a buffer overflow.
CAN-2002-1371: Zero width images allows a remote attacker to execute arbitrary code via modified chunk headers.
CAN-2002-1372: CUPS does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service.
CAN-2002-1384: The cupsys package contains some code from the xpdf package, used to convert PDF files for printing, which contains an exploitable integer overflow bug. This is not present in the potato version.

Even though we tried very hard to fix all problems in the packages for potato as well, the packages may still contain other security related problems. Hence, we advise users of potato systems using CUPS to upgrade to woody soon.

For the current stable distribution (woody), these problems have been fixed in version 1.1.14-4.3.

For the old stable distribution (potato), these problems have been fixed in version 1.0.4-12.1.

For the unstable distribution (sid), these problems have been fixed in version 1.1.18-1.

We recommend that you upgrade your CUPS packages immediately.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1.dsc; http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1.diff.gz; http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.0.4-12.1_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.0.4-12.1_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1_1.0.4-12.1_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys1-dev_1.0.4-12.1_sparc.deb

Debian GNU/Linux 3.0 (woody)

Source:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4.dsc; http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4.diff.gz; http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_alpha.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_arm.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_i386.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_ia64.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_ia64.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_ia64.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_ia64.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_ia64.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_hppa.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_hppa.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_hppa.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_hppa.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_hppa.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_m68k.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_mips.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_mips.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_mips.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_mips.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_mips.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_mipsel.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_mipsel.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_mipsel.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_mipsel.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_mipsel.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_powerpc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_s390.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_s390.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_s390.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_s390.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_s390.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.1.14-4.4_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.1.14-4.4_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.1.14-4.4_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/cupsys-pstoraster_1.1.14-4.4_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.1.14-4.4_sparc.deb; http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.1.14-4.4_sparc.deb

MD5 checksums of the listed files are available in the original advisory.

MD5 checksums of the listed files are available in the revised advisory.