Rapid7 Vulnerability & Exploit Database

RHSA-2009:0429: cups security update

Back to Search

RHSA-2009:0429: cups security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
04/23/2009
Created
07/25/2018
Added
09/12/2009
Modified
07/04/2017

Description

The Common UNIX® Printing System (CUPS) provides a portable printing layerfor UNIX operating systems.Multiple integer overflow flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0147, CVE-2009-1179)Multiple buffer overflow flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0146, CVE-2009-1182)Multiple flaws were found in the CUPS JBIG2 decoder that could lead to thefreeing of arbitrary memory. An attacker could create a malicious PDF filethat would cause CUPS to crash or, potentially, execute arbitrary codeas the "lp" user if the file was printed. (CVE-2009-0166, CVE-2009-1180)Multiple input validation flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0800)An integer overflow flaw, leading to a heap-based buffer overflow, wasdiscovered in the Tagged Image File Format (TIFF) decoding routines used bythe CUPS image-converting filters, "imagetops" and "imagetoraster". Anattacker could create a malicious TIFF file that could, potentially,execute arbitrary code as the "lp" user if the file was printed.(CVE-2009-0163)Multiple denial of service flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashwhen printed. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)Red Hat would like to thank Aaron Sigel, Braden Thomas and Drew Yao ofthe Apple Product Security team, and Will Dormann of the CERT/CC forresponsibly reporting these flaws.Users of cups are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. After installing theupdate, the cupsd daemon will be restarted automatically.

Solution(s)

  • redhat-upgrade-cups
  • redhat-upgrade-cups-devel
  • redhat-upgrade-cups-libs
  • redhat-upgrade-cups-lpd

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;