The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:053 advisory.

  - security flaw (CVE-2004-1125, CVE-2004-1267, CVE-2004-1268, CVE-2004-1269, CVE-2004-1270, CVE-2005-0064,     CVE-2005-0206)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

バナーによると、リモートホストにインストールされているCUPSのバージョンは、1.0.4から1.1.22の間です。そのようなバージョンは複数の脆弱性の影響を受けやすくなっています：

  -「hpgltops」フィルターのリモートで悪用可能なバッファオーバーフローにより、特別に細工されたHPGLファイルが、CUPS「lp」アカウントとして任意のコマンドを実行する可能性があります。

  -ローカルユーザーが、新しいパスワードファイルの一時コピーがクリーンアップされるまで、誰もパスワードを変更できないようにする可能性があります（lppasswdの欠陥）。

  -ローカルユーザーが、lppasswdの実行中にstderrファイル記述子を閉じることで、任意のコンテンツをパスワードファイルに追加できる可能性があります（lppasswdの欠陥）。

  -ローカルの攻撃者がCUPSパスワードファイルを切り捨て、ダイジェスト認証を使用する有効なクライアントへのサービスを拒否する可能性があります。（lppasswdの欠陥）。

  -アプリケーションは、大文字と小文字を区別する方法で、受信する印刷ジョブにACLを適用します。したがって、攻撃者は、ジョブを送信する際にプリンター名の大文字と小文字を変更することで、制限をバイパスできます。[1.1.21で修正済み。]

根據其標題來判斷，遠端主機上安裝的 CUPS 版本是介於 1.0.4 與 1.1.22 (含) 之間的版本。這些版本容易受到多個弱點影響：

  - 「hpgltops」篩選器中存在可從遠端惡意利用的緩衝區溢位弱點，攻擊者可使用特製的 HPGL 檔案以 CUPS「lp」帳戶的身分執行任意命令。

  - 在清理新密碼檔案的暫存複本之前，本機使用者或可阻止任何人變更其密碼 (lppasswd 瑕疵)。

  - 本機使用者或可在執行 lppasswd 時關閉 stderr 檔案描述符號，進而將任意內容新增至密碼檔案 (lppasswd 瑕疵)。

  - 本機攻擊者或可截斷 CUPS 密碼檔案，從而拒絕為使用摘要式驗證的有效用戶端提供服務 (lppasswd 瑕疵)。

  - 應用程式以區分大小寫的方式將 ACL 套用至傳入的列印工作。因此，攻擊者可在提交工作時，藉由變更印表機名稱的大小寫來繞過限制。[已在 1.1.21 版中修正。]

A buffer overflow was discovered in the ParseCommand function in the hpgltops utility. An attacker with the ability to send malicious HPGL files to a printer could possibly execute arbitrary code as the 'lp' user (CVE-2004-1267).

Vulnerabilities in the lppasswd utility were also discovered. The program ignores write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS passwd file or prevent future use of lppasswd (CVE-2004-1268 and CVE-2004-1269). As well, lppasswd does not verify that the passwd.new file is different from STDERR, which could allow a local user to control output to passwd.new via certain user input that could trigger an error message (CVE-2004-1270).

The updated packages have been patched to prevent these problems.

D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue :

First, lppasswd blithely ignores write errors in fputs(line,outfile) at lines 311 and 315 of lppasswd.c, and in fprintf(...) at line 346.
An attacker who fills up the disk at the right moment can arrange for /usr/local/etc/cups/passwd to be truncated. (CAN-2004-1268)

Second, if lppasswd bumps into a file-size resource limit while writing passwd.new, it leaves passwd.new in place, disabling all subsequent invocations of lppasswd. Any local user can thus disable lppasswd... (CAN-2004-1269)

Third, line 306 of lppasswd.c prints an error message to stderr but does not exit. This is not a problem on systems that ensure that file descriptors 0, 1, and 2 are open for setuid programs, but it is a problem on other systems; lppasswd does not check that passwd.new is different from stderr, so it ends up writing a user-controlled error message to passwd if the user closes file descriptor 2.
(CAN-2004-1270)

Note: The third issue, CVE-2004-1270, does not affect FreeBSD 4.6-RELEASE or later systems, as these systems ensure that the file descriptors 0, 1, and 2 are always open for set-user-ID and set-group-ID programs.

The remote host is affected by the vulnerability described in GLSA-200412-25 (CUPS: Multiple vulnerabilities)

    CUPS makes use of vulnerable Xpdf code to handle PDF files     (CAN-2004-1125). Furthermore, Ariel Berkman discovered a buffer     overflow in the ParseCommand function in hpgl-input.c in the hpgltops     program (CAN-2004-1267). Finally, Bartlomiej Sieka discovered several     problems in the lppasswd program: it ignores some write errors     (CAN-2004-1268), it can leave the passwd.new file in place     (CAN-2004-1269) and it does not verify that passwd.new file is     different from STDERR (CAN-2004-1270).
  Impact :

    The Xpdf and hpgltops vulnerabilities may be exploited by a remote     attacker to execute arbitrary code by sending specific print jobs to a     CUPS spooler. The lppasswd vulnerabilities may be exploited by a local     attacker to write data to the CUPS password file or deny further     password modifications.
  Workaround :

    There is no known workaround at this time.

CAN-2004-1125 :

The recent USN-48-1 fixed a buffer overflow in xpdf. Since CUPS contains xpdf code to convert incoming PDF files to the PostScript format, this vulnerability applies to cups as well.

In this case it could even lead to privilege escalation: if an attacker submitted a malicious PDF file for printing, he could be able to execute arbitrary commands with the privileges of the CUPS server.

Please note that the Ubuntu version of CUPS runs as a minimally privileged user 'cupsys' by default, so there is no possibility of root privilege escalation. The privileges of the 'cupsys' user are confined to modifying printer configurations, altering print jobs, and controlling printers.

CAN-2004-1267 :

Ariel Berkman discovered a buffer overflow in the ParseCommand() function of the HPGL input driver. If an attacker printed a malicious HPGL file, they could exploit this to execute arbitrary commands with the privileges of the CUPS server.

CAN-2004-1268, CAN-2004-1269, CAN-2004-1270 :

Bartlomiej Sieka discovered three flaws in lppasswd. These allowed users to corrupt the new password file by filling up the disk, sending certain signals, or closing the standard output and/or error streams.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of CUPS installed on the remote host is between 1.0.4 and 1.1.22 inclusive. Such versions are prone to multiple vulnerabilities :

  - A remotely exploitable buffer overflow in the 'hpgltops'     filter that enable specially crafted HPGL files can     execute arbitrary commands as the CUPS 'lp' account.

  - A local user may be able to prevent anyone from changing     their password until a temporary copy of the new     password     file is cleaned up (lppasswd flaw).

  - A local user may be able to add arbitrary content to the     password file by closing the stderr file descriptor     while running lppasswd (lppasswd flaw).

  - A local attacker may be able to truncate the CUPS     password file, thereby denying service to valid clients     using digest authentication. (lppasswd flaw).

  - The application applies ACLs to incoming print jobs in a     case-sensitive fashion. Thus, an attacker can bypass     restrictions by changing the case in printer names when     submitting jobs. [Fixed in 1.1.21.]

Updated CUPS packages that fix several security issues are now available.

The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems.

A buffer overflow was found in the CUPS pdftops filter, which uses code from the Xpdf package. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the 'lp' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1125 to this issue.

A buffer overflow was found in the ParseCommand function in the hpgltops program. An attacker who has the ability to send a malicious HPGL file to a printer could possibly execute arbitrary code as the 'lp' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1267 to this issue.

Red Hat believes that the Exec-Shield technology (enabled by default since Update 3) will block attempts to exploit these buffer overflow vulnerabilities on x86 architectures.

The lppasswd utility ignores write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS password file or prevent future uses of lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1268 and CVE-2004-1269 to these issues.

The lppasswd utility does not verify that the passwd.new file is different from STDERR, which could allow local users to control output to passwd.new via certain user input that triggers an error message.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1270 to this issue.

In addition to these security issues, two other problems not relating to security have been fixed :

Resuming a job with 'lp -H resume', which had previously been held with 'lp -H hold' could cause the scheduler to stop. This has been fixed in later versions of CUPS, and has been backported in these updated packages.

The cancel-cups(1) man page is a symbolic link to another man page.
The target of this link has been corrected.

All users of cups should upgrade to these updated packages, which resolve these issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
17174	RHEL 4 : CUPS (RHSA-2005:053)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	high
16141	CUPS < 1.1.23複数の脆弱性	Nessus	Misc.	2005/1/12	2018/7/6	high
16141	CUPS < 1.1.23 多個弱點	Nessus	Misc.	2005/1/12	2018/7/6	high
16184	Mandrake Linux Security Advisory : cups (MDKSA-2005:008)	Nessus	Mandriva Local Security Checks	2005/1/18	2021/1/6	medium
18990	FreeBSD : cups-lpr -- lppasswd multiple vulnerabilities (7850a238-680a-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
16067	GLSA-200412-25 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/12/28	2021/1/6	high
20668	Ubuntu 4.10 : cupsys vulnerabilities (USN-50-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
16141	CUPS < 1.1.23 Multiple Vulnerabilities	Nessus	Misc.	2005/1/12	2018/7/6	high
16146	RHEL 3 : cups (RHSA-2005:013)	Nessus	Red Hat Local Security Checks	2005/1/13	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

medium

medium

high

high

high

high