-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : cups
SUMMARY   : Several vulnerabilities
DATE      : 2003-07-22 16:08:00
ID        : CLA-2003:702
RELEVANT
RELEASES  : 7.0, 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
 Cups[1] (Common UNIX Printing System) is an open-source, freely
 available and cross-platform printing solution for UNIX
 environments.
 
 iDefense published[2][3] some time ago several vulnerabilities in
 Cups researched by zen-parse which are being addressed now.
 Additionally, a new denial of service vulnerability[12] was
 discovered by Phil D'Amore of Red Hat and is also being fixed.
 
 The vulnerabilities outlined below affect only Conectiva Linux 7.0
 and 8 (CL9 is not affected):
 
 1. pdftops integer overflow (CAN-2002-1384)[3][4]
 The pdftops filter used in Cups contains an integer overflow which
 can be exploited to run arbitrary commands with the privileges of the
 target user.
 
 2. Multiple integer overflows (CAN-2002-1383)[5]
 There are several integer overflows in Cups which can be exploited
 via the http interface and via carefully created images which get
 handled by Cups. These vulnerabilities can be exploited to run
 arbitrary code.
 
 3. Race condition (CAN-2002-1366)[6]
 A race condition exists in the creation of /etc/cups/certs/<pid>.
 This allows a local attacker to create or overwrite any file as root
 as long as he/she already has 'lp' privileges (which could be
 obtained via one of the previous vulnerabilities, for example).
 
 4. Arbitrary printer creation and Root Certificate Design Flaw
 (CAN-2002-1367)[7]
 Remote users can add arbitrary printers to Cups by sending a
 specially crafted UDP packet. Attackers can use this to add printers
 with tainted names that, when clicked on in the web administration
 page, could be used to exploit other vulnerabilities.
 
 5. Negative Length Memcpy() Calls (CAN-2002-1368)[8]
 Negative length memcpy() calls in the code which handles chunked
 transfer encodings and content length in the http interface could be
 used by remote attackers to cause a denial of service condition and
 possibly execute arbitrary code.
 
 6. Unsafe Strncat Function Call in jobs.c (CAN-2002-1369)[9]
 There is a buffer overflow vulnerability in the code used to handle
 job options which, in conjuntion with other vulnerabilities, could be
 used to obtain root privileges.
 
 7. Zero Width Images in filters/image-gif.c (CAN-2002-1371)[10]
 Cups does not properly check for zero-length GIF images, which allows
 remote attackers to execute arbitrary code.
 
 8. File Descriptor Resource Leaks (CAN-2002-1372)[11]
 Cups does not properly check the return values of various file and
 socket operations, which could allow a remote attacker to cause a
 denial of service condition by causing file descriptors to be
 assigned and not released.
 
 
 The vulnerability below affects Conectiva Linux 7.0, 8 and 9:
 
 9. Denial of service vulnerability (CAN-2003-0195)[12]
 Phil D'Amore discovered that by sending a partial printing request to
 the IPP port, remote attackers can cause a denial of service
 condition, since the request does not time out. Simple commands such
 as "lpq" stop working as long as the attacker holds the connection
 with the partial printing request open.
 
 
 Additionally, two other fixes which are not security related have
 been included in Conectiva Linux 7.0 and 8:
 
 1. Reconnect problem with some HP jetdirect printers;
 
 2. Octetstream has been enabled by default, which allows some
 printing jobs to be submitted such as those by Windows XP via samba.


SOLUTION
 It is recommended that all cups users upgrade their packages.
 
 IMPORTANT: after the upgrade, it is necessary to restart the cups
 service if it was already running. To do so, execute the following
 command as root:
 
 /sbin/service cups restart


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/cups-1.1.14-1U70_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/cups-1.1.14-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/cups-devel-1.1.14-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/cups-devel-static-1.1.14-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/cups-doc-1.1.14-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/cups-libs-1.1.14-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/cups-1.1.14-2U80_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/cups-1.1.14-2U80_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/cups-devel-1.1.14-2U80_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/cups-devel-static-1.1.14-2U80_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/cups-doc-1.1.14-2U80_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/cups-libs-1.1.14-2U80_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/cups-1.1.18-29091U90_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/cups-1.1.18-29091U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/cups-devel-1.1.18-29091U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/cups-devel-static-1.1.18-29091U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/cups-doc-1.1.18-29091U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/cups-libs-1.1.18-29091U90_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/HYwc42jd0JmAcZARAtiUAKDplssuctl81JeOczaInYu9G8OVqwCgz2Um
50JG8ogfPb/GNqRa5Je7OJo=
=ar/E
-----END PGP SIGNATURE-----