|
|
Family: Ubuntu Local Security Checks --> Category: infos
USN50-1 : cupsys vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
cupsys vulnerabilities
Detailed Explanation for this Vulnerability Test
Synopsis :
These remote packages are missing security patches :
- cupsys
- cupsys-bsd
- cupsys-client
- libcupsimage2
- libcupsimage2-dev
- libcupsys2-dev
- libcupsys2-gnutls10
Description :
CVE-2004-1125:
The recent USN-48-1 fixed a buffer overflow in xpdf. Since CUPS
contains xpdf code to convert incoming PDF files to the PostScript
format, this vulnerability applies to cups as well.
In this case it could even lead to privilege escalation: if an
attacker submitted a malicious PDF file for printing, he could be
able to execute arbitrary commands with the rights of the
CUPS server.
Please note that the Ubuntu version of CUPS runs as a minimally
privileged user 'cupsys' by default, so there is no possibility of
root privilege escalation. The rights of the 'cupsys' user are
confined to modifying printer configurations, altering print jobs,
and controlling printers.
CVE-2004-1267:
Ariel Berkman discovered a buffer overflow in the ParseCommand()
function of the HPGL input driver. If a possible hacker printed a
malicious HPGL file, they could exploit this to execute arbitrary
commands with the rights of the CUPS server.
CVE-2004-1268, CVE-2004-1269, CAN
[...]
Solution :
Upgrade to :
- cupsys-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- cupsys-bsd-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- cupsys-client-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsimage2-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsimage2-dev-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsys2-dev-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
- libcupsys2-gnutls10-1.1.20final+cvs20040330-4ubuntu16.3 (Ubuntu 4.10)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
