バナーによると、リモートホストにインストールされているCUPSのバージョンには、「backend / snmp.c」の「asn1_get_string」にスタックベースの整数オーバーフローが含まれています。SNMPバックエンドがCUPSで構成されている場合（CUPS 1.2ではデフォルトで trueだが1.3ではそうではない）、攻撃者はこの問題を悪用して、負の長さを有する、特別に細工されたSNMP応答を使用して、バッファをオーバーフローさせ、影響を受けるシステム上で任意のコードを実行できる可能性があります。

リモートホストが GLSA-201412-11 で説明されている脆弱性の影響を受けます（AMD64 x86 エミュレーションベースライブラリ：複数の脆弱性）

AMD64 x86 エミュレーションベースライブラリに複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

コンテキスト依存の攻撃者が、任意のコードの実行やサービス拒否状態を引き起こしたり、機密情報を取得したりする可能性があります。
 回避策：

現時点で、既知の回避策はありません。

Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code (CVE-2007-5849).

As well, the fix for CVE-2007-0720 in MDKSA-2007:086 caused another denial of service regression within SSL handling (CVE-2007-4045).

The updated packages have been patched to correct these issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only.

Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. If a user were tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code.

Elias Pipping discovered that temporary files were not handled safely in certain situations when converting PDF to PS. A local attacker could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200712-14 (CUPS: Multiple vulnerabilities)

    Wei Wang (McAfee AVERT Research) discovered an integer underflow in the     asn1_get_string() function of the SNMP backend, leading to a     stack-based buffer overflow when handling SNMP responses     (CVE-2007-5849). Elias Pipping (Gentoo) discovered that the alternate     pdftops filter creates temporary files with predictable file names when     reading from standard input (CVE-2007-6358). Furthermore, the     resolution of a Denial of Service vulnerability covered in GLSA     200703-28 introduced another Denial of Service vulnerability within SSL     handling (CVE-2007-4045).
  Impact :

    A remote attacker on the local network could exploit the first     vulnerability to execute arbitrary code with elevated privileges by     sending specially crafted SNMP messages as a response to an SNMP     broadcast request. A local attacker could exploit the second     vulnerability to overwrite arbitrary files with the privileges of the     user running the CUPS spooler (usually lp) by using symlink attacks. A     remote attacker could cause a Denial of Service condition via the third     vulnerability when SSL is enabled in CUPS.
  Workaround :

    To disable SNMP support in CUPS, you have have to manually delete the     file '/usr/libexec/cups/backend/snmp'. Please note that the file is     reinstalled if you merge CUPS again later. To disable the pdftops     filter, delete all lines referencing 'pdftops' in CUPS' 'mime.convs'     configuration file. To work around the third vulnerability, disable SSL     support via the corresponding USE flag.

根据其标题，远程主机上安装的 CUPS 版本的“backend/snmp.c”的“asn1_get_string”中包含一个基于堆栈的整数溢出漏洞。如果 SNMP 后端在 CUPS 中配置（在 CUPS 1.2 中而非 1.3 中默认为 true），攻击者可能会通过使用特别构建且长度为负的 SNMP 响应来利用此问题，导致缓冲区溢出并在受影响的系统上执行任意代码。

远程主机受到 GLSA-201412-11 中所述漏洞的影响（AMD64 x86 仿真基础库：多种漏洞）

在 AMD64 x86 仿真基础库中发现了多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

上下文有关的攻击者也许能够执行任意代码、造成拒绝服务情况或获取敏感信息。
 变通方案：

目前无任何已知的变通方案。

According to its banner, the version of CUPS installed on the remote host contains a stack-based integer overflow in 'asn1_get_string' in 'backend/snmp.c'. Provided the SNMP backend is configured in CUPS (true by default in CUPS 1.2 but not 1.3), an attacker may be able to exploit this issue by using specially crafted SNMP responses with negative lengths to overflow a buffer and execute arbitrary code on the affected system.

Several local vulnerabilities have been discovered in the Common UNIX Printing System. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5849     Wei Wang discovered that an buffer overflow in the SNMP     backend may lead to the execution of arbitrary code.

  - CVE-2007-6358     Elias Pipping discovered that insecure handling of a     temporary file in the pdftops.pl script may lead to     local denial of service. This vulnerability is not     exploitable in the default configuration.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

根據其標題來判斷，遠端主機上安裝的 CUPS 版本在「backend/snmp.c」的「asn1_get_string」中有一個堆疊型整數溢位問題。倘若已經在 CUPS 中設定 SNMP 後端 (CUPS 1.2 版預設為 true，1.3 版中則不然)，則攻擊者可以利用此問題，使用長度為負數的特製 SNMP 回應造成緩衝區溢位，並在受影響的系統上執行任意程式碼。

遠端主機受到 GLSA-201412-11 中所述的弱點影響 (AMD64 x86 模擬基本程式庫：多個弱點)

在 AMD64 x86 模擬基本程式庫中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

內容相依的攻擊者可執行任意程式碼、造成拒絕服務情形，或是取得敏感資訊。
 因應措施：

目前尚無已知的因應措施。

The remote host is running the Common Unix Printing System (CUPS) daemon.  This version of CUPS is vulnerable to a remote buffer overflow.  The flaw is in the way that CUPS handles SNMP responses.  An attacker sending a malformed SNMP response would be able to execute arbitrary code on the remote system.  In order to exploit this flaw, the attacker would need for SNMP to be enabled on the CUPS server as well as the ability to intercept and respond to SNMP messages bound for valid hosts.

ID	名稱	產品	系列	已發布	已更新	嚴重性
29727	CUPS SNMPバックエンド（backend/snmp.c）のasn1_get_string関数の細工されたSNMP応答のリモートオーバーフロー	Nessus	Misc.	2007/12/19	2018/11/15	high
79964	GLSA-201412-11：AMD64 x86 エミュレーションベースライブラリ：複数の脆弱性（Heartbleed）	Nessus	Gentoo Local Security Checks	2014/12/15	2022/5/5	critical
37571	Mandriva Linux Security Advisory : cups (MDVSA-2008:036)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	2007/12/18	2024/5/28	critical
29914	openSUSE 10 Security Update : cups (cups-4806)	Nessus	SuSE Local Security Checks	2008/1/10	2021/1/14	high
29919	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-563-1)	Nessus	Ubuntu Local Security Checks	2008/1/10	2021/1/19	high
29734	GLSA-200712-14 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/12/19	2021/1/6	high
29727	CUPS SNMP 后端 (backend/snmp.c) asn1_get_string 函数构建的 SNMP 响应远程溢出	Nessus	Misc.	2007/12/19	2018/11/15	high
79964	GLSA-201412-11：AMD64 x86 仿真基础库：多种漏洞 (Heartbleed)	Nessus	Gentoo Local Security Checks	2014/12/15	2022/5/5	critical
29727	CUPS SNMP Back End (backend/snmp.c) asn1_get_string Function Crafted SNMP Response Remote Overflow	Nessus	Misc.	2007/12/19	2018/11/15	high
29803	Debian DSA-1437-1 : cupsys - several vulnerabilities	Nessus	Debian Local Security Checks	2007/12/27	2021/1/4	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	2014/12/15	2022/5/5	critical
29727	CUPS SNMP 後端 (backend/snmp.c) asn1_get_string 函式特製 SNMP 回應遠端溢位	Nessus	Misc.	2007/12/19	2018/11/15	high
79964	GLSA-201412-11：AMD64 x86 模擬基本程式庫：多個弱點 (Heartbleed)	Nessus	Gentoo Local Security Checks	2014/12/15	2022/5/5	critical
4320	CUPS < 1.3.5 Back End SNMP Response Remote Overflow	Nessus Network Monitor	Web Servers	2007/12/18	2019/3/6	medium

偵測

搜尋 Plugin

high

critical

high

critical

high

high

high

high

critical

high

high

critical

high

critical

medium