full-disclosure - [ MDVSA-2010:073 ] cups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1O25Og-0005HL-64@titan.mandriva.com>
Date: Wed, 14 Apr 2010 18:25:02 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:073 ] cups


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:073
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : cups
 Date    : April 14, 2010
 Affected: 2008.0, 2009.0, 2009.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in cups:
 
 CUPS in does not properly handle (1) HTTP headers and (2) HTML
 templates, which allows remote attackers to conduct cross-site
 scripting (XSS) attacks and HTTP response splitting attacks via vectors
 related to (a) the product's web interface, (b) the configuration of
 the print system, and (c) the titles of printed jobs (CVE-2009-2820).
 
 Use-after-free vulnerability in the abstract file-descriptor handling
 interface in the cupsdDoSelect function in scheduler/select.c in the
 scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers
 to cause a denial of service (daemon crash or hang) via a client
 disconnection during listing of a large number of print jobs, related
 to improperly maintaining a reference count.  NOTE: some of these
 details are obtained from third party information (CVE-2009-3553).
 
 Use-after-free vulnerability in the abstract file-descriptor handling
 interface in the cupsdDoSelect function in scheduler/select.c in the
 scheduler in cupsd in CUPS 1.3.7, 1.3.9, 1.3.10, and 1.4.1, when kqueue
 or epoll is used, allows remote attackers to cause a denial of service
 (daemon crash or hang) via a client disconnection during listing
 of a large number of print jobs, related to improperly maintaining
 a reference count.  NOTE: some of these details are obtained from
 third party information.  NOTE: this vulnerability exists because of
 an incomplete fix for CVE-2009-3553 (CVE-2010-0302).
 
 The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS
 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable
 to determine the file that provides localized message strings, which
 allows local users to gain privileges via a file that contains crafted
 localization data with format string specifiers (CVE-2010-0393).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2820
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3553
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0302
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0393
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 a32a4128da2ed9e16c9c32dfc9096808  2008.0/i586/cups-1.3.10-0.2mdv2008.0.i586.rpm
 711dcd4a509abd67bf967ae828370bfe  2008.0/i586/cups-common-1.3.10-0.2mdv2008.0.i586.rpm
 aff4928b801486fafa9a799dee913245  2008.0/i586/cups-serial-1.3.10-0.2mdv2008.0.i586.rpm
 b23f0c512bd99b3c36b155a585e14648  2008.0/i586/libcups2-1.3.10-0.2mdv2008.0.i586.rpm
 4d5a3e7f8cc569b7eeed96a4f1b5d43a  2008.0/i586/libcups2-devel-1.3.10-0.2mdv2008.0.i586.rpm
 a5222f5bb8861a38b43c7a8151b21954  2008.0/i586/php-cups-1.3.10-0.2mdv2008.0.i586.rpm 
 d8bdac011d50accff618549a1fb0ea87  2008.0/SRPMS/cups-1.3.10-0.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 bc2c7e3fc59bb883e104018d1b24c7db  2008.0/x86_64/cups-1.3.10-0.2mdv2008.0.x86_64.rpm
 da1a026eaaa97507103dd99956367e2a  2008.0/x86_64/cups-common-1.3.10-0.2mdv2008.0.x86_64.rpm
 7315d16e8a97793d40a313a330f1abb7  2008.0/x86_64/cups-serial-1.3.10-0.2mdv2008.0.x86_64.rpm
 c6d4513b8137ec1bd51932f4f4a234af  2008.0/x86_64/lib64cups2-1.3.10-0.2mdv2008.0.x86_64.rpm
 e656177d1b558cb1a0514f167d66bb95  2008.0/x86_64/lib64cups2-devel-1.3.10-0.2mdv2008.0.x86_64.rpm
 30335b899039b4873a7a963367565e95  2008.0/x86_64/php-cups-1.3.10-0.2mdv2008.0.x86_64.rpm 
 d8bdac011d50accff618549a1fb0ea87  2008.0/SRPMS/cups-1.3.10-0.2mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 f597fcba45e4fe74d94461a85c95e8e3  2009.0/i586/cups-1.3.10-0.3mdv2009.0.i586.rpm
 feca5a7f5ac3b520d33fee752ab4f8fc  2009.0/i586/cups-common-1.3.10-0.3mdv2009.0.i586.rpm
 cc460c58ee0684a7fba6e4bf2d3b62e5  2009.0/i586/cups-serial-1.3.10-0.3mdv2009.0.i586.rpm
 099fa99032ba0ce9b228c58299cd4143  2009.0/i586/libcups2-1.3.10-0.3mdv2009.0.i586.rpm
 0a6a1219b2a6abe9011deb9de06ad7ad  2009.0/i586/libcups2-devel-1.3.10-0.3mdv2009.0.i586.rpm
 9fc21c66b8e8d0a88c38f5fbaf5e2218  2009.0/i586/php-cups-1.3.10-0.3mdv2009.0.i586.rpm 
 977d5d5d741abd078f9c778c9c5f87d4  2009.0/SRPMS/cups-1.3.10-0.3mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 f3caa52b521fe6a2435c909fe3d749e2  2009.0/x86_64/cups-1.3.10-0.3mdv2009.0.x86_64.rpm
 723d9585ffe96108b3cfb200c66416c0  2009.0/x86_64/cups-common-1.3.10-0.3mdv2009.0.x86_64.rpm
 8440aaaaf3fdd2906f19ba1dd452d8e4  2009.0/x86_64/cups-serial-1.3.10-0.3mdv2009.0.x86_64.rpm
 05b817ebb19000f792c8a678ca8a753c  2009.0/x86_64/lib64cups2-1.3.10-0.3mdv2009.0.x86_64.rpm
 ee70e4f2a99f70f43d9ce3739f3df02b  2009.0/x86_64/lib64cups2-devel-1.3.10-0.3mdv2009.0.x86_64.rpm
 24100da63a536198dc9be90d34639aa5  2009.0/x86_64/php-cups-1.3.10-0.3mdv2009.0.x86_64.rpm 
 977d5d5d741abd078f9c778c9c5f87d4  2009.0/SRPMS/cups-1.3.10-0.3mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 1fdc6b511f5faa11ac2d7cd627e8bf31  2009.1/i586/cups-1.3.10-2.1mdv2009.1.i586.rpm
 3a891de6be4319e5496e78189012aa21  2009.1/i586/cups-common-1.3.10-2.1mdv2009.1.i586.rpm
 3964d695f67298681fe034c8707eae67  2009.1/i586/cups-serial-1.3.10-2.1mdv2009.1.i586.rpm
 df46de6b34731b19e0a8947e50e56e6b  2009.1/i586/libcups2-1.3.10-2.1mdv2009.1.i586.rpm
 fb03ba3cb724dc809064ff7bb82b7a7b  2009.1/i586/libcups2-devel-1.3.10-2.1mdv2009.1.i586.rpm
 3bf091ef3124955ada16a2bc9f30f7ba  2009.1/i586/php-cups-1.3.10-2.1mdv2009.1.i586.rpm 
 7ca4461463fdcd16522518fa0c798717  2009.1/SRPMS/cups-1.3.10-2.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 aae0bab16794d20c20feb4450367d0f4  2009.1/x86_64/cups-1.3.10-2.1mdv2009.1.x86_64.rpm
 ba63f6843a5731835ca4b349a361c571  2009.1/x86_64/cups-common-1.3.10-2.1mdv2009.1.x86_64.rpm
 65a8eb61eb47355138dade7c179ec8b0  2009.1/x86_64/cups-serial-1.3.10-2.1mdv2009.1.x86_64.rpm
 917bd3f5420b2414e32b7ff1993fa613  2009.1/x86_64/lib64cups2-1.3.10-2.1mdv2009.1.x86_64.rpm
 546124c7d6a82b39175dadcdad7dc34d  2009.1/x86_64/lib64cups2-devel-1.3.10-2.1mdv2009.1.x86_64.rpm
 36140e585a4b521ece1f008590c9393f  2009.1/x86_64/php-cups-1.3.10-2.1mdv2009.1.x86_64.rpm 
 7ca4461463fdcd16522518fa0c798717  2009.1/SRPMS/cups-1.3.10-2.1mdv2009.1.src.rpm

 Mandriva Enterprise Server 5:
 417b487c7654246671c3dfd45dae74fa  mes5/i586/cups-1.3.10-0.3mdvmes5.1.i586.rpm
 caf89e446df41929e212568affeb13d8  mes5/i586/cups-common-1.3.10-0.3mdvmes5.1.i586.rpm
 ae056c41db1315aed42dfa109bb672d4  mes5/i586/cups-serial-1.3.10-0.3mdvmes5.1.i586.rpm
 69d1c6262d245be0e8859c1e0437b6ee  mes5/i586/libcups2-1.3.10-0.3mdvmes5.1.i586.rpm
 6d43b681d01a12b28c211257b5ac05f0  mes5/i586/libcups2-devel-1.3.10-0.3mdvmes5.1.i586.rpm
 418911b3240205fc4529ea9df7d03a3f  mes5/i586/php-cups-1.3.10-0.3mdvmes5.1.i586.rpm 
 a6c3d0d372aa9696588feb6b4fc054ab  mes5/SRPMS/cups-1.3.10-0.3mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 694b289a0743a43ecdbcaa6ec4cb03bc  mes5/x86_64/cups-1.3.10-0.3mdvmes5.1.x86_64.rpm
 43e7dee0f6d9f8c6ae08db7e73202a18  mes5/x86_64/cups-common-1.3.10-0.3mdvmes5.1.x86_64.rpm
 52e7e3df9a69c05da7f5a8fae98b4d58  mes5/x86_64/cups-serial-1.3.10-0.3mdvmes5.1.x86_64.rpm
 4d9863ff196e7faf66f481d0bdd27880  mes5/x86_64/lib64cups2-1.3.10-0.3mdvmes5.1.x86_64.rpm
 c98ff3d4976315ffab534d4b1ad31761  mes5/x86_64/lib64cups2-devel-1.3.10-0.3mdvmes5.1.x86_64.rpm
 4e9ec802c5001fabaca3245b1742ab24  mes5/x86_64/php-cups-1.3.10-0.3mdvmes5.1.x86_64.rpm 
 a6c3d0d372aa9696588feb6b4fc054ab  mes5/SRPMS/cups-1.3.10-0.3mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLxb12mqjQ0CJFipgRAl8CAKDDXnwgxuAzaXTv4f4A7wL74oL2qwCdFu1V
tzCAILGeZfAzEjKULOu/2fY=
=xGJZ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/