[PLDSA 12-1] New cups packages fix several vulnerabilities

Thu Jan 30 14:10:21 CET 2003

- --------------------------------------------------------------------------
PLD Security Advisory PLDSA 12-1                        security at pld.org.pl
http://www.pld.org.pl/security/                          PLD Security Team
11 January 2003 			http://www.pld.org.pl/security/faq
- --------------------------------------------------------------------------

Package        : prior to cups-1.1.14-21		
Vulnerability  : several
Problem-Type   : remote
PLD-specific   : no
CVE references : CAN-2002-1366, CAN-2002-1367, CAN-2002-1368, CAN-2002-1369, CAN-2002-1371,
CAN-2002-1372, CAN-2002-1383, CAN-2002-1384

Multiple vulnerabilities were discovered in the Common Unix Printing
System (CUPS).  Several of these issues represent the potential for a
remote compromise or denial of service.  The Common Vulnerabilities
and Exposures project identifies the following problems:

. CAN-2002-1366: Race conditions in connection with /etc/cups/certs/
  allow local users with lp privileges to create or overwrite
  arbitrary files.

. CAN-2002-1367: This vulnerabilities allows a remote attacker to add
  printers without authentication via a certain UDP packet, which can
  then be used to perform unauthorized activities such as stealing
  the local root certificate for the administration server via a
  "need authorization" page.

. CAN-2002-1368: Negative lengths fed into memcpy() can cause a
  denial of service and possibly execute arbitrary code.

. CAN-2002-1369: An unsafe strncat() function call processing the
  options string allows a remote attacker to execute arbitrary code
  via a buffer overflow.

. CAN-2002-1371: Zero width images allows a remote attacker to
  execute arbitrary code via modified chunk headers.

. CAN-2002-1372: CUPS does not properly check the return values of
  various file and socket operations, which could allow a remote
  attacker to cause a denial of service.

. CAN-2002-1383: Multiple integer overflows allow a remote attacker
  to execute arbitrary code via the CUPSd HTTP interface and the
  image handling code in CUPS filters.

. CAN-2002-1384: The cupsys package contains some code from the xpdf
  package, used to convert PDF files for printing, which contains an
  exploitable integer overflow bug.

The above problems have been fixed in version 1.1.14-22 for the
current stable distribution (ra).

We recommend that you upgrade your cups packages.

wget -c url
	will fetch the file for you
rpm -Uhv file(s)*.rpm
        will upgrade the referenced file.

If you are using "poldek" - the package manager, use the line as given below
for upgrade packages

poldek --update
        will update the internal database
poldek --upgrade 'cups*'
        will install corrected packages

If you are using "apt" - the package manager, use the line as given below
for upgrade packages

apt-get update
        will update the internal database
apt-get upgrade 'cups*'
        will install corrected packages

PLD Linux 1.0 alias ra
- --------------------

  Source archives:

ftp://ftp.pld.org.pl/dists/ra/updates/security/SRPMS/cups-1.1.14-22.src.rpm
       MD5 checksum: eaad706536733bb5016bafcf026de651

  I386 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-1.1.14-22.i386.rpm
       MD5 checksum: e0e906dfa0a054d5d953857f3fb83437

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-clients-1.1.14-22.i386.rpm
       MD5 checksum: 1d6d70828db0548362d611839e14b08d

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-devel-1.1.14-22.i386.rpm
       MD5 checksum: 883115ac579765f48cdcf02176867424

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-image-lib-1.1.14-22.i386.rpm
       MD5 checksum: 56388fa68e3c6868f293aac69f0c3472

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-lib-1.1.14-22.i386.rpm
       MD5 checksum: c64efe08b059390290a92337af06f30a

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/cups-static-1.1.14-22.i386.rpm
       MD5 checksum: d969097a4c23ecac5e2f0e465db41184

  I586 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-1.1.14-22.i586.rpm
       MD5 checksum: d1efaf1328e27a867af9b2c528ed8eec

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-clients-1.1.14-22.i586.rpm
       MD5 checksum: 9e7471bfdd4306db402e667d33f36cd9

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-devel-1.1.14-22.i586.rpm
       MD5 checksum: 0722464d3ab6da79888fcccefe9ca64d

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-image-lib-1.1.14-22.i586.rpm
       MD5 checksum: a695fb82367df3384b70576bd1f782e3

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-lib-1.1.14-22.i586.rpm
       MD5 checksum: b2b84c5a773f7ad454cce82dd7d90147

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/cups-static-1.1.14-22.i586.rpm
       MD5 checksum: 17fcbe0367f966b104918129e2fee1db

  I686 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-1.1.14-22.i686.rpm
       MD5 checksum: a80675bf0c3ebe2c70182abbd558423f

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-clients-1.1.14-22.i686.rpm
       MD5 checksum: 768b830b3b8e1d4e8d916f223ee66943

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-devel-1.1.14-22.i686.rpm
       MD5 checksum: 868ce98d028ca2481634ea593c9f1401

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-image-lib-1.1.14-22.i686.rpm
       MD5 checksum: 67528a07af150b9a2f946b555a246540

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-lib-1.1.14-22.i686.rpm
       MD5 checksum: c17b4adef73a8344cba4b204a0d0fed3

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/cups-static-1.1.14-22.i686.rpm
       MD5 checksum: 65fd8ab1e014cf139d7df587715bcf09

  PowerPC Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-1.1.14-22.ppc.rpm
       MD5 checksum: 50234d4867bf02fa6140cde160858f8a

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-clients-1.1.14-22.ppc.rpm
       MD5 checksum: 47593a0c1a7891989dc2cf635cbc9a1e

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-devel-1.1.14-22.ppc.rpm
       MD5 checksum: 40ce0d745505b3a3f1994f002bd5c4c0

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-image-lib-1.1.14-22.ppc.rpm
       MD5 checksum: 42d9e4a6cbb985c28397f29940e8ca28

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-lib-1.1.14-22.ppc.rpm
       MD5 checksum: bd389690f29f7c3fa3b065c1a00fec91

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/cups-static-1.1.14-22.ppc.rpm
       MD5 checksum: fc67e944260d6ec81d855ecd87b15bbd

-
--------------------------------------------------------------------------------
-
If you are using poldek add this line to poldek.conf.
If you are using apt-get add this line to sources.list.

For i386 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i386 base updates-security
For i586 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i586 base updates-security
For i686 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i686 base updates-security
For ppc architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/ppc base updates-security