Bugtraq mailing list archives
Re: iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS)
From: zen-parse <zen-parse () gmx net>
Date: Sun, 22 Dec 2002 15:29:18 +1300 (NZDT)
Joe Testa (Joe_Testa () rapid7 com) wrote:
So, it doesn't seem like CUPSd is vulnerable to just any random attacker who happens to be passing by. I've tested this against RedHat 8.0's 'cups-1.1.15-10.src.rpm', along with ftp.cups.org's v1.1.14 and v1.1.17.
Maybe not just any random attacker. Depending on configuration the server may be setup to allow access from other machines on the local network. (Check the access control list stuff). This, of course, probably never happens in the real world. I mean, it would be too useful to be able to share a printer. So of course, it wouldn't affect anyone. Adding a feature to allow it was probably just an exercise to see if they could do it. </sarcasm> The original advisory said: Exploitation of multiple CUPS vulnerabilities allow local and remote attackers in the worst of the scenarios to gain root privileges. Notice 'worst case' in the sentence? Remote access can also be given (via issue 1) by sending an email with an image link that exploits the handling of variables, allowing execution of commands on the local machine. This can then be used to further elevate privs via the issue you mentioned, or one of the other issues. -- zen-parse -- ------------------------------------------------------------------------- 1) If this message was posted to a public forum by zen-parse () gmx net, it may be redistributed without modification. 2) In any other case the contents of this message is confidential and not to be distributed in any form without express permission from the author.
Current thread:
- iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) iDEFENSE Labs (Dec 19)
- <Possible follow-ups>
- Re: iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) Joe Testa (Dec 21)
- Re: iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) zen-parse (Dec 21)