Security update for package cups

Knowledgebase

(Last modified: 07JAN2003)

solutions Security update for package cups SuSE Linux Maintenance Web (fd49e9dbce3ea25e111d005556e7cfb4)

Applies to

Product(s): SuSE Linux Enterprise Server 8 for x86
SuSE Linux Enterprise Server 8 for IBM iSeries and IBM pSeries
SuSE Linux Enterprise Server 8 for IBM S/390 and IBM zSeries
SuSE Linux Enterprise Server 8 for IBM zSeries
SuSE Linux Openexchange Server 4

Package: cups
Release: 20030107
Obsoletes: none

Indications

Everybody using CUPS should install this package.

Contraindications

None.

Problem description

iDEFENSE discovered multiple vulnerabilities in the Unix printing system CUPS. The following bugs were found:

an integer overflow in the HTTP interface to gain remote access with CUPS privileges
a local file race condition to gain root permissions (the bug mentioned above has to be exploited first, though)
remote addition of printers is possible
a remote denial-of-service and possible remote root exploit due to negative length memcpy() call
an integer overflow in image handling code and the pdftops filter to gain higher privileges
local root permissions can be gained due to a buffer overflow of the options buffer
a design problem to gain local root (needs added printer, see above)
wrong handling of zero width images can be abused to gain higher privileges
a file descriptor leak and denial-of-service due to missing checks of return values of file/socket operations

Solution

Please install the updates provided at the location noted below.

Installation notes

This update is provided as an RPM package that can easily be installed onto a running system by using this command:
rpm -Fvh cups.rpm
Please restart CUPS with rccups restart after the installation of the update.

links to download packages

Download Source Packages

Download the source code of the patches for maintained products.

Disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.

Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.