-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:073 http://www.mandriva.com/security/ _______________________________________________________________________ Package : cups Date : April 14, 2010 Affected: 2008.0, 2009.0, 2009.1, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in cups: CUPS in does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs (CVE-2009-2820). Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information (CVE-2009-3553). Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7, 1.3.9, 1.3.10, and 1.4.1, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553 (CVE-2010-0302). The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers (CVE-2010-0393). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2820 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3553 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0302 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0393 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: a32a4128da2ed9e16c9c32dfc9096808 2008.0/i586/cups-1.3.10-0.2mdv2008.0.i586.rpm 711dcd4a509abd67bf967ae828370bfe 2008.0/i586/cups-common-1.3.10-0.2mdv2008.0.i586.rpm aff4928b801486fafa9a799dee913245 2008.0/i586/cups-serial-1.3.10-0.2mdv2008.0.i586.rpm b23f0c512bd99b3c36b155a585e14648 2008.0/i586/libcups2-1.3.10-0.2mdv2008.0.i586.rpm 4d5a3e7f8cc569b7eeed96a4f1b5d43a 2008.0/i586/libcups2-devel-1.3.10-0.2mdv2008.0.i586.rpm a5222f5bb8861a38b43c7a8151b21954 2008.0/i586/php-cups-1.3.10-0.2mdv2008.0.i586.rpm d8bdac011d50accff618549a1fb0ea87 2008.0/SRPMS/cups-1.3.10-0.2mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: bc2c7e3fc59bb883e104018d1b24c7db 2008.0/x86_64/cups-1.3.10-0.2mdv2008.0.x86_64.rpm da1a026eaaa97507103dd99956367e2a 2008.0/x86_64/cups-common-1.3.10-0.2mdv2008.0.x86_64.rpm 7315d16e8a97793d40a313a330f1abb7 2008.0/x86_64/cups-serial-1.3.10-0.2mdv2008.0.x86_64.rpm c6d4513b8137ec1bd51932f4f4a234af 2008.0/x86_64/lib64cups2-1.3.10-0.2mdv2008.0.x86_64.rpm e656177d1b558cb1a0514f167d66bb95 2008.0/x86_64/lib64cups2-devel-1.3.10-0.2mdv2008.0.x86_64.rpm 30335b899039b4873a7a963367565e95 2008.0/x86_64/php-cups-1.3.10-0.2mdv2008.0.x86_64.rpm d8bdac011d50accff618549a1fb0ea87 2008.0/SRPMS/cups-1.3.10-0.2mdv2008.0.src.rpm Mandriva Linux 2009.0: f597fcba45e4fe74d94461a85c95e8e3 2009.0/i586/cups-1.3.10-0.3mdv2009.0.i586.rpm feca5a7f5ac3b520d33fee752ab4f8fc 2009.0/i586/cups-common-1.3.10-0.3mdv2009.0.i586.rpm cc460c58ee0684a7fba6e4bf2d3b62e5 2009.0/i586/cups-serial-1.3.10-0.3mdv2009.0.i586.rpm 099fa99032ba0ce9b228c58299cd4143 2009.0/i586/libcups2-1.3.10-0.3mdv2009.0.i586.rpm 0a6a1219b2a6abe9011deb9de06ad7ad 2009.0/i586/libcups2-devel-1.3.10-0.3mdv2009.0.i586.rpm 9fc21c66b8e8d0a88c38f5fbaf5e2218 2009.0/i586/php-cups-1.3.10-0.3mdv2009.0.i586.rpm 977d5d5d741abd078f9c778c9c5f87d4 2009.0/SRPMS/cups-1.3.10-0.3mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: f3caa52b521fe6a2435c909fe3d749e2 2009.0/x86_64/cups-1.3.10-0.3mdv2009.0.x86_64.rpm 723d9585ffe96108b3cfb200c66416c0 2009.0/x86_64/cups-common-1.3.10-0.3mdv2009.0.x86_64.rpm 8440aaaaf3fdd2906f19ba1dd452d8e4 2009.0/x86_64/cups-serial-1.3.10-0.3mdv2009.0.x86_64.rpm 05b817ebb19000f792c8a678ca8a753c 2009.0/x86_64/lib64cups2-1.3.10-0.3mdv2009.0.x86_64.rpm ee70e4f2a99f70f43d9ce3739f3df02b 2009.0/x86_64/lib64cups2-devel-1.3.10-0.3mdv2009.0.x86_64.rpm 24100da63a536198dc9be90d34639aa5 2009.0/x86_64/php-cups-1.3.10-0.3mdv2009.0.x86_64.rpm 977d5d5d741abd078f9c778c9c5f87d4 2009.0/SRPMS/cups-1.3.10-0.3mdv2009.0.src.rpm Mandriva Linux 2009.1: 1fdc6b511f5faa11ac2d7cd627e8bf31 2009.1/i586/cups-1.3.10-2.1mdv2009.1.i586.rpm 3a891de6be4319e5496e78189012aa21 2009.1/i586/cups-common-1.3.10-2.1mdv2009.1.i586.rpm 3964d695f67298681fe034c8707eae67 2009.1/i586/cups-serial-1.3.10-2.1mdv2009.1.i586.rpm df46de6b34731b19e0a8947e50e56e6b 2009.1/i586/libcups2-1.3.10-2.1mdv2009.1.i586.rpm fb03ba3cb724dc809064ff7bb82b7a7b 2009.1/i586/libcups2-devel-1.3.10-2.1mdv2009.1.i586.rpm 3bf091ef3124955ada16a2bc9f30f7ba 2009.1/i586/php-cups-1.3.10-2.1mdv2009.1.i586.rpm 7ca4461463fdcd16522518fa0c798717 2009.1/SRPMS/cups-1.3.10-2.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: aae0bab16794d20c20feb4450367d0f4 2009.1/x86_64/cups-1.3.10-2.1mdv2009.1.x86_64.rpm ba63f6843a5731835ca4b349a361c571 2009.1/x86_64/cups-common-1.3.10-2.1mdv2009.1.x86_64.rpm 65a8eb61eb47355138dade7c179ec8b0 2009.1/x86_64/cups-serial-1.3.10-2.1mdv2009.1.x86_64.rpm 917bd3f5420b2414e32b7ff1993fa613 2009.1/x86_64/lib64cups2-1.3.10-2.1mdv2009.1.x86_64.rpm 546124c7d6a82b39175dadcdad7dc34d 2009.1/x86_64/lib64cups2-devel-1.3.10-2.1mdv2009.1.x86_64.rpm 36140e585a4b521ece1f008590c9393f 2009.1/x86_64/php-cups-1.3.10-2.1mdv2009.1.x86_64.rpm 7ca4461463fdcd16522518fa0c798717 2009.1/SRPMS/cups-1.3.10-2.1mdv2009.1.src.rpm Mandriva Enterprise Server 5: 417b487c7654246671c3dfd45dae74fa mes5/i586/cups-1.3.10-0.3mdvmes5.1.i586.rpm caf89e446df41929e212568affeb13d8 mes5/i586/cups-common-1.3.10-0.3mdvmes5.1.i586.rpm ae056c41db1315aed42dfa109bb672d4 mes5/i586/cups-serial-1.3.10-0.3mdvmes5.1.i586.rpm 69d1c6262d245be0e8859c1e0437b6ee mes5/i586/libcups2-1.3.10-0.3mdvmes5.1.i586.rpm 6d43b681d01a12b28c211257b5ac05f0 mes5/i586/libcups2-devel-1.3.10-0.3mdvmes5.1.i586.rpm 418911b3240205fc4529ea9df7d03a3f mes5/i586/php-cups-1.3.10-0.3mdvmes5.1.i586.rpm a6c3d0d372aa9696588feb6b4fc054ab mes5/SRPMS/cups-1.3.10-0.3mdvmes5.1.src.rpm Mandriva Enterprise Server 5/X86_64: 694b289a0743a43ecdbcaa6ec4cb03bc mes5/x86_64/cups-1.3.10-0.3mdvmes5.1.x86_64.rpm 43e7dee0f6d9f8c6ae08db7e73202a18 mes5/x86_64/cups-common-1.3.10-0.3mdvmes5.1.x86_64.rpm 52e7e3df9a69c05da7f5a8fae98b4d58 mes5/x86_64/cups-serial-1.3.10-0.3mdvmes5.1.x86_64.rpm 4d9863ff196e7faf66f481d0bdd27880 mes5/x86_64/lib64cups2-1.3.10-0.3mdvmes5.1.x86_64.rpm c98ff3d4976315ffab534d4b1ad31761 mes5/x86_64/lib64cups2-devel-1.3.10-0.3mdvmes5.1.x86_64.rpm 4e9ec802c5001fabaca3245b1742ab24 mes5/x86_64/php-cups-1.3.10-0.3mdvmes5.1.x86_64.rpm a6c3d0d372aa9696588feb6b4fc054ab mes5/SRPMS/cups-1.3.10-0.3mdvmes5.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLxb12mqjQ0CJFipgRAl8CAKDDXnwgxuAzaXTv4f4A7wL74oL2qwCdFu1V tzCAILGeZfAzEjKULOu/2fY= =xGJZ -----END PGP SIGNATURE-----
