ID CVE-2009-0949
Summary The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
References
Vulnerable Configurations
  • Apple CUPS 1.1
    cpe:2.3:a:apple:cups:1.1
  • Apple CUPS 1.1.1
    cpe:2.3:a:apple:cups:1.1.1
  • Apple CUPS 1.1.2
    cpe:2.3:a:apple:cups:1.1.2
  • Apple CUPS 1.1.3
    cpe:2.3:a:apple:cups:1.1.3
  • Apple CUPS 1.1.4
    cpe:2.3:a:apple:cups:1.1.4
  • Apple CUPS 1.1.5
    cpe:2.3:a:apple:cups:1.1.5
  • Apple CUPS 1.1.5-1
    cpe:2.3:a:apple:cups:1.1.5-1
  • Apple CUPS 1.1.5-2
    cpe:2.3:a:apple:cups:1.1.5-2
  • Apple CUPS 1.1.6
    cpe:2.3:a:apple:cups:1.1.6
  • Apple CUPS 1.1.6-1
    cpe:2.3:a:apple:cups:1.1.6-1
  • Apple CUPS 1.1.6-2
    cpe:2.3:a:apple:cups:1.1.6-2
  • Apple CUPS 1.1.6-3
    cpe:2.3:a:apple:cups:1.1.6-3
  • Apple CUPS 1.1.7
    cpe:2.3:a:apple:cups:1.1.7
  • Apple CUPS 1.1.8
    cpe:2.3:a:apple:cups:1.1.8
  • Apple CUPS 1.1.9
    cpe:2.3:a:apple:cups:1.1.9
  • Apple CUPS 1.1.9-1
    cpe:2.3:a:apple:cups:1.1.9-1
  • Apple CUPS 1.1.10
    cpe:2.3:a:apple:cups:1.1.10
  • Apple CUPS 1.1.10-1
    cpe:2.3:a:apple:cups:1.1.10-1
  • Apple CUPS 1.1.11
    cpe:2.3:a:apple:cups:1.1.11
  • Apple CUPS 1.1.12
    cpe:2.3:a:apple:cups:1.1.12
  • Apple CUPS 1.1.13
    cpe:2.3:a:apple:cups:1.1.13
  • Apple CUPS 1.1.14
    cpe:2.3:a:apple:cups:1.1.14
  • Apple CUPS 1.1.15
    cpe:2.3:a:apple:cups:1.1.15
  • Apple CUPS 1.1.16
    cpe:2.3:a:apple:cups:1.1.16
  • Apple CUPS 1.1.17
    cpe:2.3:a:apple:cups:1.1.17
  • Apple CUPS 1.18
    cpe:2.3:a:apple:cups:1.1.18
  • Apple CUPS 1.1.19
    cpe:2.3:a:apple:cups:1.1.19
  • Apple CUPS 1.1.19 release candidate 1
    cpe:2.3:a:apple:cups:1.1.19:rc1
  • Apple CUPS 1.1.19 release candidate 2
    cpe:2.3:a:apple:cups:1.1.19:rc2
  • Apple CUPS 1.1.19 release candidate 3
    cpe:2.3:a:apple:cups:1.1.19:rc3
  • Apple CUPS 1.1.19 release candidate 4
    cpe:2.3:a:apple:cups:1.1.19:rc4
  • Apple CUPS 1.1.19 release candidate 5
    cpe:2.3:a:apple:cups:1.1.19:rc5
  • Apple CUPS 1.1.20
    cpe:2.3:a:apple:cups:1.1.20
  • Apple CUPS 1.1.20 release candidate 1
    cpe:2.3:a:apple:cups:1.1.20:rc1
  • Apple CUPS 1.1.20 release candidate 2
    cpe:2.3:a:apple:cups:1.1.20:rc2
  • Apple CUPS 1.1.20 release candidate 3
    cpe:2.3:a:apple:cups:1.1.20:rc3
  • Apple CUPS 1.1.20 release candidate 4
    cpe:2.3:a:apple:cups:1.1.20:rc4
  • Apple CUPS 1.1.20 release candidate 5
    cpe:2.3:a:apple:cups:1.1.20:rc5
  • Apple CUPS 1.1.20 release candidate 6
    cpe:2.3:a:apple:cups:1.1.20:rc6
  • Apple CUPS 1.1.21
    cpe:2.3:a:apple:cups:1.1.21
  • Apple CUPS 1.1.21 release candidate 1
    cpe:2.3:a:apple:cups:1.1.21:rc1
  • Apple CUPS 1.1.21 release candidate 2
    cpe:2.3:a:apple:cups:1.1.21:rc2
  • Apple CUPS 1.1.22
    cpe:2.3:a:apple:cups:1.1.22
  • Apple CUPS 1.1.22 release candidate 1
    cpe:2.3:a:apple:cups:1.1.22:rc1
  • Apple CUPS 1.1.22 release candidate 2
    cpe:2.3:a:apple:cups:1.1.22:rc2
  • Apple CUPS 1.1.23
    cpe:2.3:a:apple:cups:1.1.23
  • Apple CUPS 1.1.23 release candidate 1
    cpe:2.3:a:apple:cups:1.1.23:rc1
  • Apple CUPS 1.2 b1
    cpe:2.3:a:apple:cups:1.2:b1
  • Apple CUPS 1.2 b2
    cpe:2.3:a:apple:cups:1.2:b2
  • Apple CUPS 1.2 release candidate 1
    cpe:2.3:a:apple:cups:1.2:rc1
  • Apple CUPS 1.2 release candidate 2
    cpe:2.3:a:apple:cups:1.2:rc2
  • Apple CUPS 1.2 release candidate 3
    cpe:2.3:a:apple:cups:1.2:rc3
  • Apple CUPS 1.2.0
    cpe:2.3:a:apple:cups:1.2.0
  • Apple CUPS 1.2.1
    cpe:2.3:a:apple:cups:1.2.1
  • Apple CUPS 1.2.2
    cpe:2.3:a:apple:cups:1.2.2
  • Apple CUPS 1.2.3
    cpe:2.3:a:apple:cups:1.2.3
  • Apple CUPS 1.2.4
    cpe:2.3:a:apple:cups:1.2.4
  • Apple CUPS 1.2.5
    cpe:2.3:a:apple:cups:1.2.5
  • Apple CUPS 1.2.6
    cpe:2.3:a:apple:cups:1.2.6
  • Apple CUPS 1.2.7
    cpe:2.3:a:apple:cups:1.2.7
  • Apple CUPS 1.2.8
    cpe:2.3:a:apple:cups:1.2.8
  • Apple CUPS 1.2.9
    cpe:2.3:a:apple:cups:1.2.9
  • Apple CUPS 1.2.10
    cpe:2.3:a:apple:cups:1.2.10
  • Apple CUPS 1.2.11
    cpe:2.3:a:apple:cups:1.2.11
  • Apple CUPS 1.2.12
    cpe:2.3:a:apple:cups:1.2.12
  • Apple CUPS 1.3 b1
    cpe:2.3:a:apple:cups:1.3:b1
  • Apple CUPS 1.3 release candidate 1
    cpe:2.3:a:apple:cups:1.3:rc1
  • Apple CUPS 1.3 release candidate 2
    cpe:2.3:a:apple:cups:1.3:rc2
  • Apple CUPS 1.3.0
    cpe:2.3:a:apple:cups:1.3.0
  • Apple CUPS 1.3.1
    cpe:2.3:a:apple:cups:1.3.1
  • Apple CUPS 1.3.2
    cpe:2.3:a:apple:cups:1.3.2
  • Apple CUPS 1.3.3
    cpe:2.3:a:apple:cups:1.3.3
  • Apple CUPS 1.3.4
    cpe:2.3:a:apple:cups:1.3.4
  • Apple CUPS 1.3.5
    cpe:2.3:a:apple:cups:1.3.5
  • Apple CUPS 1.3.6
    cpe:2.3:a:apple:cups:1.3.6
  • Apple CUPS 1.3.7
    cpe:2.3:a:apple:cups:1.3.7
  • Apple CUPS 1.3.8
    cpe:2.3:a:apple:cups:1.3.8
  • Apple CUPS 1.3.9
    cpe:2.3:a:apple:cups:1.3.9
CVSS
Base: 5.0 (as of 09-06-2009 - 14:10)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
exploit-db via4
description CUPS 1.3.9 'cups/ipp.c' NULL Pointer Dereference Denial Of Service Vulnerability. CVE-2009-0949. Dos exploit for linux platform
id EDB-ID:33020
last seen 2016-02-03
modified 2009-06-02
published 2009-06-02
reporter Anibal Sacco
source https://www.exploit-db.com/download/33020/
title CUPS <= 1.3.9 - 'cups/ipp.c' NULL Pointer Dereference Denial Of Service Vulnerability
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_12434.NASL
    description The following bugs have been fixed : - The 'pdftops' was prone to several integer overflows. (CVE-2009-0791) - The cups daemon could crash when receiving IPP requests with multiple unsupported tags. (CVE-2009-0949)
    last seen 2019-02-21
    modified 2016-12-21
    plugin id 41304
    published 2009-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=41304
    title SuSE9 Security Update : CUPS (YOU Patch Number 12434)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-6279.NASL
    description The 'pdftops' was prone to several integer overflows (CVE-2009-0791). The cups daemon could crash when receiving IPP requests with multiple unsupported tags. (CVE-2009-0949)
    last seen 2019-02-21
    modified 2016-12-22
    plugin id 41495
    published 2009-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=41495
    title SuSE 10 Security Update : CUPS (ZYPP Patch Number 6279)
  • NASL family Misc.
    NASL id CUPS_1_3_10.NASL
    description According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10. Such versions are affected by several issues : - A potential integer overflow in the PNG image validation code in '_cupsImageReadPNG()' could allow an attacker to crash the affected service or possibly execute arbitrary code. (STR #2974) - A heap-based integer overflow exists in '_cupsImageReadTIFF()' due to a failure to properly validate the image height of a specially crafted TIFF file, which can be leveraged to execute arbitrary code. (STR #3031) - The web interface may be vulnerable to DNS rebinding attacks due to a failure to validate the HTTP Host header in incoming requests. (STR #3118) - A heap-based buffer overflow in pdftops allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments. (CVE-2009-0195) - Flawed 'ip' structure initialization in the function 'ippReadIO()' could allow an anonymous remote attacker to crash the application via a malicious IPP request packet with two consecutives IPP_TAG_UNSUPPORTED tags. (CVE-2009-0949)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 36183
    published 2009-04-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36183
    title CUPS < 1.3.10 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2009-005.NASL
    description The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied. This security update contains fixes for the following products : - Alias Manager - CarbonCore - ClamAV - ColorSync - CoreGraphics - CUPS - Flash Player plug-in - ImageIO - Launch Services - MySQL - PHP - SMB - Wiki Server
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 40945
    published 2009-09-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40945
    title Mac OS X Multiple Vulnerabilities (Security Update 2009-005)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1811.NASL
    description Anibal Sacco discovered that cups, a general printing system for UNIX systems, suffers from NULL pointer dereference because of its handling of two consecutive IPP packets with certain tag attributes that are treated as IPP_TAG_UNSUPPORTED tags. This allows unauthenticated attackers to perform denial of service attacks by crashing the cups daemon.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 38992
    published 2009-06-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=38992
    title Debian DSA-1811-1 : cups, cupsys - null ptr dereference
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2009-1082.NASL
    description Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue. Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 39306
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39306
    title RHEL 5 : cups (RHSA-2009:1082)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20090603_CUPS_ON_SL3_X.NASL
    description A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196) Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791) After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60592
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60592
    title Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2009-1083.NASL
    description Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. The CUPS 'pdftops' filter converts Portable Document Format (PDF) files to PostScript. 'pdftops' is based on Xpdf and the CUPS imaging library. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196) Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting the CVE-2009-1196 flaw. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 39303
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39303
    title CentOS 3 / 4 : cups (CESA-2009:1083)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2009-1083.NASL
    description Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. The CUPS 'pdftops' filter converts Portable Document Format (PDF) files to PostScript. 'pdftops' is based on Xpdf and the CUPS imaging library. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196) Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting the CVE-2009-1196 flaw. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 39307
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39307
    title RHEL 3 / 4 : cups (RHSA-2009:1083)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-6285.NASL
    description The 'pdftops' was prone to several integer overflows (CVE-2009-0791). The cups daemon could crash when receiving IPP requests with multiple unsupported tags (CVE-2009-0949).
    last seen 2019-02-21
    modified 2016-12-22
    plugin id 39389
    published 2009-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39389
    title openSUSE 10 Security Update : cups (cups-6285)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2009-1082.NASL
    description Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue. Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 43754
    published 2010-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43754
    title CentOS 5 : cups (CESA-2009:1082)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2009-282.NASL
    description Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap. (CVE-2009-0146, CVE-2009-0147) Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow. (CVE-2009-0163) Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to g*allocn. (CVE-2009-0165) The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory. (CVE-2009-0166) Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments (CVE-2009-0195). Multiple integer overflows in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179. (CVE-2009-0791) The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read. (CVE-2009-0799) Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-0800) The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags. (CVE-2009-0949) Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-1179) The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data. (CVE-2009-1180) The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference. (CVE-2009-1181) Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file. (CVE-2009-1182) The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file. (CVE-2009-1183) Two integer overflow flaws were found in the CUPS pdftops filter. An attacker could create a malicious PDF file that would cause pdftops to crash or, potentially, execute arbitrary code as the lp user if the file was printed. (CVE-2009-3608, CVE-2009-3609) This update corrects the problems. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 42181
    published 2009-10-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42181
    title Mandriva Linux Security Advisory : cups (MDVSA-2009:282-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2009-1083.NASL
    description From Red Hat Security Advisory 2009:1083 : Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. The CUPS 'pdftops' filter converts Portable Document Format (PDF) files to PostScript. 'pdftops' is based on Xpdf and the CUPS imaging library. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) A use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes. An attacker could use this flaw to cause a denial of service (cupsd daemon stop or crash). (CVE-2009-1196) Multiple integer overflows flaws, leading to heap-based buffer overflows, were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2009-0791) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting the CVE-2009-0949 flaw, and Swen van Brussel for reporting the CVE-2009-1196 flaw. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67868
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67868
    title Oracle Linux 3 / 4 : cups (ELSA-2009-1083)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2009-1082.NASL
    description From Red Hat Security Advisory 2009:1082 : Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949) Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue. Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67867
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67867
    title Oracle Linux 5 : cups (ELSA-2009-1082)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-780-1.NASL
    description Anibal Sacco discovered that CUPS did not properly handle certain network operations. A remote attacker could exploit this flaw and cause the CUPS server to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 39311
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39311
    title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : cups, cupsys vulnerability (USN-780-1)
oval via4
accepted 2013-04-29T04:20:51.784-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
family unix
id oval:org.mitre.oval:def:9631
status accepted
submitted 2010-07-09T03:56:16-04:00
title The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
version 24
packetstorm via4
data source https://packetstormsecurity.com/files/download/78040/CORE-2009-0420.txt
id PACKETSTORM:78040
last seen 2016-12-05
published 2009-06-03
reporter Core Security Technologies
source https://packetstormsecurity.com/files/78040/Core-Security-Technologies-Advisory-2009.0420.html
title Core Security Technologies Advisory 2009.0420
redhat via4
advisories
  • bugzilla
    id 500972
    title CVE-2009-0949 cups: IPP_TAG_UNSUPPORTED handling NULL pointer dereference DoS
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment cups is earlier than 1:1.3.7-8.el5_3.6
          oval oval:com.redhat.rhsa:tst:20091082002
        • comment cups is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070123014
      • AND
        • comment cups-devel is earlier than 1:1.3.7-8.el5_3.6
          oval oval:com.redhat.rhsa:tst:20091082006
        • comment cups-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070123020
      • AND
        • comment cups-libs is earlier than 1:1.3.7-8.el5_3.6
          oval oval:com.redhat.rhsa:tst:20091082004
        • comment cups-libs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070123018
      • AND
        • comment cups-lpd is earlier than 1:1.3.7-8.el5_3.6
          oval oval:com.redhat.rhsa:tst:20091082008
        • comment cups-lpd is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070123016
    rhsa
    id RHSA-2009:1082
    released 2009-06-03
    severity Important
    title RHSA-2009:1082: cups security update (Important)
  • rhsa
    id RHSA-2009:1083
rpms
  • cups-1:1.3.7-8.el5_3.6
  • cups-devel-1:1.3.7-8.el5_3.6
  • cups-libs-1:1.3.7-8.el5_3.6
  • cups-lpd-1:1.3.7-8.el5_3.6
  • cups-1:1.1.17-13.3.62
  • cups-devel-1:1.1.17-13.3.62
  • cups-libs-1:1.1.17-13.3.62
  • cups-1:1.1.22-0.rc1.9.32.el4_8.3
  • cups-devel-1:1.1.22-0.rc1.9.32.el4_8.3
  • cups-libs-1:1.1.22-0.rc1.9.32.el4_8.3
refmap via4
apple APPLE-SA-2009-09-10-2
bid 35169
bugtraq 20090602 CORE-2009-0420 - Apple CUPS IPP_TAG_UNSUPPORTED Handling null pointer Vulnerability
confirm
debian DSA-1811
misc http://www.coresecurity.com/content/AppleCUPS-null-pointer-vulnerability
sectrack 1022321
secunia
  • 35322
  • 35328
  • 35340
  • 35342
  • 35685
  • 36701
suse SUSE-SR:2009:012
ubuntu USN-780-1
xf apple-cups-ipptag-dos(50926)
Last major update 21-08-2010 - 01:31
Published 09-06-2009 - 13:30
Last modified 10-10-2018 - 15:32
Back to Top