The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1388 advisory.

    - Applied upstream patch to fix CVE-2014-5029 (bug #1122600),       CVE-2014-5030 (bug #1128764), CVE-2014-5031 (bug #1128767).
    - fix patch for CVE-2014-3537 (bug #1117794)
    - CVE-2014-2856: cross-site scripting flaw (bug #1117798)
    - CVE-2014-3537: insufficient checking leads to privilege escalation (bug #1117794)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A cross-site scripting (XSS) flaw was found in the CUPS web interface.
An attacker could use this flaw to perform a cross-site scripting attack against users of the CUPS web interface. (CVE-2014-2856)

It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the 'lp' group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system. (CVE-2014-3537 , CVE-2014-5029 , CVE-2014-5030 , CVE-2014-5031)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Revert change to whitelist /rss/ resources, as this was     not used upstream.

  - More STR #4461 fixes from upstream: make rss feeds     world-readable, but cachedir private.

  - Fix icon display in web interface during server restart     (STR #4475).

  - Fixes for upstream patch for STR #4461: allow /rss/     requests for files we created.

  - Use upstream patch for STR #4461.

  - Applied upstream patch to fix CVE-2014-5029 (bug     #1122600), CVE-2014-5030 (bug #1128764), CVE-2014-5031     (bug #1128767).

  - Fix conf/log file reading for authenticated users (STR     #4461).

  - Fix CGI handling (STR #4454, bug #1120419).

  - fix patch for CVE-2014-3537 (bug #1117794)

  - CVE-2014-2856: cross-site scripting flaw (bug #1117798)

  - CVE-2014-3537: insufficient checking leads to privilege     escalation (bug #1117794)

  - Removed package description changes.

  - Applied patch to fix 'Bad request' errors as a result of     adding in httpSetTimeout (STR #4440, also part of svn     revision 9967).

  - Fixed timeout issue with cupsd reading when there is no     data ready (bug #1110045).

  - Fixed synconclose patch to avoid 'too many arguments for     format' warning.

  - Fixed settimeout patch to include math.h for fmod     declaration.

  - Fixed typo preventing web interface from changing driver     (bug #1104483, STR #3601).

  - Fixed SyncOnClose patch (bug #984883).

  - Use upstream patch to avoid replaying GSS credentials     (bug #1040293).

  - Prevent BrowsePoll problems across suspend/resume (bug     #769292) :

  - Eliminate indefinite wait for response (svn revision     9688).

  - Backported httpSetTimeout API function from CUPS 1.5 and     use it in the ipp backend so that we wait indefinitely     until the printer responds, we get a hard error, or the     job is cancelled.

  - cups-polld: reconnect on error.

  - Added new SyncOnClose directive to use fsync after     altering configuration files: defaults to 'Yes'. Adjust     in cupsd.conf (bug #984883).

  - Fix cupsctl man page typo (bug #1011076).

  - Use more portable rpm specfile syntax for conditional     php building (bug #988598).

  - Fix SetEnv directive in cupsd.conf (bug #986495).

  - Fix 'collection' attribute sending (bug #978387).

  - Prevent format_log segfault (bug #971079).

  - Prevent stringpool corruption (bug #884851).

  - Don't crash when job queued for printer that times out     (bug #855431).

  - Upstream patch for broken multipart handling (bug     #852846).

  - Install /etc/cron.daily/cups with correct permissions     (bug #1012482).

  - Fixes for jobs with multiple files and multiple formats     (bug #972242).

  - Applied patch to fix CVE-2012-5519 (privilege escalation     for users in SystemGroup or with equivalent polkit     permission). This prevents HTTP PUT requests with paths     under /admin/conf/ other than that for cupsd.conf, and     also prevents such requests altering certain     configuration directives such as PageLog and FileDevice     (bug #875898).

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A cross-site scripting flaw was found in the cups web     templating engine. An attacker could use this flaw to     bypass the default configuration settings that bind the     CUPS scheduler to the 'localhost' or loopback     interface.(CVE-2015-1159)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5031)

  - A string reference count bug was found in cupsd,     causing premature freeing of string objects. An     attacker could submit a malicious print job that     exploits this flaw to dismantle ACLs protecting     privileged operations, allowing a replacement     configuration file to be uploaded, which in turn     allowed the attacker to run arbitrary code on the CUPS     server.(CVE-2015-1158)

  - A cross-site scripting (XSS) flaw was found in the CUPS     web interface. An attacker could use this flaw to     perform a cross-site scripting attack against users of     the CUPS web interface.(CVE-2014-2856)

  - A localhost.localdomain whitelist entry in valid_host()     in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by     sending POST requests to the CUPS daemon in conjunction     with DNS rebinding. The localhost.localdomain name is     often resolved via a DNS server (neither the OS nor the     web browser is responsible for ensuring that     localhost.localdomain is 127.0.0.1).(CVE-2017-18190)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5030)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-3537)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the way CUPS handled     compressed raster image files. An attacker could create     a specially crafted image file that, when passed via     the CUPS Raster filter, could cause the CUPS filter to     crash.(CVE-2014-9679)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 2.0 之前版本的 CUPS 中的 Web 接口不会检查文件是否具有全局可读权限，这允许远程攻击者通过不明矢量获取敏感信息。 (CVE-2014-5031)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

此更新修复了 CUPS 中的多种问题。

- 多种不充分的符号链接检查可导致 lp 用户的权限升级到根用户。
 (CVE-2014-3537/ CVE-2014-5029/CVE-2014-5030/CVE-2014-5031)

更新后的 cups 程序包修复了多个安全问题和若干缺陷，现在可用于 Red Hat Enterprise Linux 6。

Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

CUPS 提供了用于 Linux、UNIX 和类似操作系统的便携式打印层。

在 CUPS Web 界面中发现跨站脚本 (XSS) 缺陷。
攻击者可利用此缺陷针对 CUPS Web 界面的用户执行跨站脚本攻击。(CVE-2014-2856)

已发现 CUPS 允许特定用户在 /var/cache/cups/ 之下的特定目录中创建符号链接。具有“lp”群组权限的本地用户可以利用此缺陷读取系统上任意文件的内容，或可升级其在系统中的权限。（CVE-2014-3537、CVE-2014-5029、CVE-2014-5030、CVE-2014-5031）

CVE-2014-3537 问题由 Red Hat 产品安全的 Francisco Alonso 发现。

这些更新后的 cups 程序包也包括多个缺陷补丁。空间有限，无法在此公告中记载所有这些更改。有关这些更改的最重要的信息，用户可参阅在“参考”部分链接的 Red Hat Enterprise Linux 6.6 技术札记。

建议所有 cups 用户升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。安装此更新后，cupsd 后台程序将自动重新启动。

在 CUPS Web 界面中发现跨站脚本 (XSS) 缺陷。
攻击者可利用此缺陷针对 CUPS Web 界面的用户执行跨站脚本攻击。(CVE-2014-2856)

已发现 CUPS 允许特定用户在 /var/cache/cups/ 之下的特定目录中创建符号链接。具有“lp”群组权限的本地用户可以利用此缺陷读取系统上任意文件的内容，或可升级其在系统中的权限。（CVE-2014-3537、CVE-2014-5029、CVE-2014-5030、CVE-2014-5031）

安装此更新后，cupsd 后台程序将自动重新启动。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 2.0 版之前的 CUPS 中的 Web 介面未檢查檔案是否具有任何人皆可讀取的權限，進而允許遠端攻擊者透過不明向量取得敏感資訊。 (CVE-2014-5031)

請注意，Nessus 依賴供應商報告的套件存在。

此更新可修正 CUPS 中的多種問題。

- 多種不足符號連結檢查可導致從 lp 使用者到 root 的權限提升。
 (CVE-2014-3537 / CVE-2014-5029 / CVE-2014-5030 / CVE-2014-5031)

現已提供適用於 Red Hat Enterprise Linux 6 的更新版 cups 套件，可修正多個安全性問題和數個錯誤。

Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

CUPS 為 Linux、UNIX 和相似作業系統提供可攜式列印層。

在 CUPS web 介面中發現跨網站指令碼 (XSS) 瑕疵。
攻擊者可利用此瑕疵，對 CUPS web 介面使用者執行跨網站指令碼攻擊。(CVE-2014-2856)

據發現，CUPS 允許某些使用者在 /var/cache/cups/ 之下的特定目錄中建立符號連結。具有「lp」群組權限的本機使用者可利用此瑕疵讀取系統上任意檔案的內容，或可能提升其在系統上的權限。(CVE-2014-3537、CVE-2014-5029、CVE-2014-5030、CVE-2014-5031)

CVE-2014-3537 問題是由 Red Hat 產品安全性團隊的 Francisco Alonso 所發現。

這些更新版 cups 套件還提供數個錯誤修正。因空間所限，無法在此公告中記錄所有這些變更。系統將使用者導向至<參照>一節中的 Red Hat Enterprise Linux 6.6「技術提示」文件連結，以便其瞭解這些變更中最重要項目的資訊。

建議所有 cups 使用者皆升級至這些更新版套件，其中包含可修正這些問題的反向移植修補程式。安裝此更新之後，cupsd 程序將會自動重新啟動。

在 CUPS web 介面中發現跨網站指令碼 (XSS) 瑕疵。
攻擊者可利用此瑕疵，對 CUPS web 介面使用者執行跨網站指令碼攻擊。(CVE-2014-2856)

據發現，CUPS 允許某些使用者在 /var/cache/cups/ 之下的特定目錄中建立符號連結。具有「lp」群組權限的本機使用者可利用此瑕疵讀取系統上任意檔案的內容，或可能提升其在系統上的權限。(CVE-2014-3537、CVE-2014-5029、CVE-2014-5030、CVE-2014-5031)

安裝此更新之後，cupsd 程序將會自動重新啟動。

ID	名稱	產品	系列	已發布	已更新	嚴重性
78522	Oracle Linux 6 : cups (ELSA-2014-1388)	Nessus	Oracle Linux Local Security Checks	2014/10/17	2024/10/22	medium
78781	Amazon Linux AMI : cups (ALAS-2014-438)	Nessus	Amazon Linux Local Security Checks	2014/11/3	2018/4/18	medium
79550	OracleVM 3.3 : cups (OVMSA-2014-0035)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
124935	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1432)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
218257	Linux Distros 未修补的漏洞: CVE-2014-5031	Nessus	Misc.	2025/3/4	2025/3/4	medium
77217	SuSE 11.3 安全更新：CUPS（SAT 修补程序编号 9561）	Nessus	SuSE Local Security Checks	2014/8/15	2021/1/19	medium
78405	RHEL 6：cups (RHSA-2014:1388)	Nessus	Red Hat Local Security Checks	2014/10/14	2021/1/14	medium
78842	Scientific Linux 安全更新：SL6.x i386/x86_64 中的 cups	Nessus	Scientific Linux Local Security Checks	2014/11/4	2021/1/14	medium
218257	Linux Distros 未修補弱點：CVE-2014-5031	Nessus	Misc.	2025/3/4	2025/3/4	medium
77217	SuSE 11.3 安全性更新：CUPS (SAT 修補程式編號 9561)	Nessus	SuSE Local Security Checks	2014/8/15	2021/1/19	medium
78405	RHEL 6 : cups (RHSA-2014:1388)	Nessus	Red Hat Local Security Checks	2014/10/14	2021/1/14	medium
78842	Scientific Linux 安全性更新：SL6.x i386/x86_64 上的 cups	Nessus	Scientific Linux Local Security Checks	2014/11/4	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium