$arr_19 ), array( 3, false, $arr_20, $arr_24 ), array( 2, false, "\" />", $arr_25 ) ) ); ?> $arr_27 ), array( 3, false, $arr_28, $arr_30 ), array( 2, false, "\" />\n\n", $arr_31 ) ) ); ?> array( 2, false, false, $arr_9 ), array( 4, $arr_10, "if", $arr_245, $arr_248 ), array( 2, false, "\n", $arr_249 ) ) ); ?> rr_466 ), array( 4, $arr_467, "if", $arr_482, $arr_484 ), array( 2, false, "\n", $arr_485 ) ) ); ?> CUPS Vulnerability Allows Attackers to Execute Code » Linux Magazine
 

CUPS Vulnerability Allows Attackers to Execute Code

Oct 31, 2007

Security researchers at Secunia have discovered a vulnerability in the Cups printing system.

A vulnerability detected in the standard printing system on Linux and Mac OS X, Cups, has been assigned the CVE number 2007-4351.

In the original advisory the Secunia experts write that the problem is caused by an error in the "ippReadIO()" function in the "cups/ipp.c" file. The vulnerability occurs when IPP tags (Internet Printing Protocol) are executed. Attackers could exploit the vulnerability by sending an IPP request with carefully crafted "textWithLanguage" or "nameWithLanguage" tags. This overwrites a byte on the stack with a zero. If the attack succeeds, the attacker may be able to execute arbitrary code on the target system.

The error was found in Cups 1.3.3 although other versions may be affected. As an update is not available at present, security experts recommend restricting the use of the printing system to trusted network environments.

comments powered by Disqus

Issue 152/2013

Tag Cloud

Bruce Byfield Gnome KDE Kernel Linux Linux Pro Magazine Open Source Projects Red Hat Ubuntu events foss free software google

News