Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: Ubuntu Local Security Checks --> Category: infos

USN50-1 : cupsys vulnerabilities Vulnerability Scan

Vulnerability Scan Summary
cupsys vulnerabilities

Detailed Explanation for this Vulnerability Test

Synopsis :

These remote packages are missing security patches :
- cupsys
- cupsys-bsd
- cupsys-client
- libcupsimage2
- libcupsimage2-dev
- libcupsys2-dev
- libcupsys2-gnutls10

Description :


The recent USN-48-1 fixed a buffer overflow in xpdf. Since CUPS
contains xpdf code to convert incoming PDF files to the PostScript
format, this vulnerability applies to cups as well.

In this case it could even lead to privilege escalation: if an
attacker submitted a malicious PDF file for printing, he could be
able to execute arbitrary commands with the rights of the
CUPS server.

Please note that the Ubuntu version of CUPS runs as a minimally
privileged user 'cupsys' by default, so there is no possibility of
root privilege escalation. The rights of the 'cupsys' user are
confined to modifying printer configurations, altering print jobs,
and controlling printers.


Ariel Berkman discovered a buffer overflow in the ParseCommand()
function of the HPGL input driver. If a possible hacker printed a
malicious HPGL file, they could exploit this to execute arbitrary
commands with the rights of the CUPS server.

CVE-2004-1268, CVE-2004-1269, CAN

Solution :

Upgrade to :
- cupsys-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- cupsys-bsd-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- cupsys-client-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsimage2-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsimage2-dev-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsys2-dev-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsys2-gnutls10-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)

Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.