CUPS Print Server Vulnerabilities Removed

Apr 03, 2008

The new 1.3.7 is the CUPS developers have closed down several vulnerabilities in the popular print server.

On networks that ran CUPS as a print server, potential attackers could provoke a heap-based buffer overflow via the "cgiCompileSearch()" search function implemented by the CGI interface if the printer was shared. A carefully crafted search request was required to do this. The exploit gave attackers the ability to assumed the privileges of the user accounts running the service and to execute code. Security researchers iDefence discovered the vulnerability, which is classified as CVE ID CVE-2008-0047, in CUPS version 1.3.5, although older versions may also be affected.

This also applies to bug CVE-2008-1373 which was provoked by GIF image files. If image files had an invalid value in the "code_size" field, a buffer overflow could be provoked. The new release also removes a couple of minor errrors in CUPS. Check out the release notes for more details.

The new 1.3.7 version is now available for downloading. Distributors will be providing updated packages shortly.

Related content

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More