Apple CUPS Daemon: unauthenticated SIGSEGV crash via RSS subscriptions

[ap]

Binary package hint: cups

The CUPS daemon (/usr/sbin/cupsd) which listens by default on port 631/tcp, crashes when more than 100 RSS Subscriptions are added. No authentication is required to perform such action. The caveat is that by default - at least on Ubuntu and openSuse - the daemon only accepts connections from localhost as specified by the default configuration settings (/etc/cups/cupsd.conf). However, the attack can be of remote nature by tricking the victim user to visit a specially-crafted page. Such page would forge the 'add rss subscription' request 101 times which causes the CUPS daemon to crash.

The CUPS daemon runs by default on Ubuntu, openSuse and probably other GNU/Linux distributions. Additionally, this vulnerability can be replicated against CUPS daemons using default settings. Since no authentication is required to add new RSS subscriptions, the CUPS administrator does not need to be logged in during exploitation.

It is not known whether the crash can lead to command execution, further debugging/investigation is required. However, the daemon runs as root on both Ubuntu and openSuse (and probably other distributions), which means that given that command execution is possible, this bug would lead to a full compromise of the targeted system.

_Please see the attached file for more details._

[ap (a.p)]

no problem. thanks!

On Wed, Nov 19, 2008 at 6:59 PM, Kees Cook <email address hidden> wrote:
> ** Visibility changed to: Public
>
> --
> Apple CUPS Daemon: unauthenticated SIGSEGV crash via RSS subscriptions
> https://bugs.launchpad.net/bugs/298241
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in "cups" source package in Ubuntu: New
>
> Bug description:
> Binary package hint: cups
>
> The CUPS daemon (/usr/sbin/cupsd) which listens by default on port 631/tcp, crashes when more than 100 RSS Subscriptions are added. No authentication is required to perform such action. The caveat is that by default - at least on Ubuntu and openSuse - the daemon only accepts connections from localhost as specified by the default configuration settings (/etc/cups/cupsd.conf). However, the attack can be of remote nature by tricking the victim user to visit a specially-crafted page. Such page would forge the 'add rss subscription' request 101 times which causes the CUPS daemon to crash.
>
> The CUPS daemon runs by default on Ubuntu, openSuse and probably other GNU/Linux distributions. Additionally, this vulnerability can be replicated against CUPS daemons using default settings. Since no authentication is required to add new RSS subscriptions, the CUPS administrator does not need to be logged in during exploitation.
>
> It is not known whether the crash can lead to command execution, further debugging/investigation is required. However, the daemon runs as root on both Ubuntu and openSuse (and probably other distributions), which means that given that command execution is possible, this bug would lead to a full compromise of the targeted system.
>
> _Please see the attached file for more details._
>

--
Adrian 'pagvac' Pastor | GNUCITIZEN | gnucitizen.org
PGP Key ID: 0x6B232C7C

[ap (a.p)]

More info here: http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/

[Martin Pitt (pitti)]

I'll deal with the jaunty/Debian update. I was fairly sure that http://www.cups.org/strfiles/2774/str2774.patch fixed it (in cups 1.3.8), I just get a live-locked browser (tons of message boxes), but cupsd stays alive. I followed up to the Debian bug.

[ap (a.p)]

@Martin: check out the comments on http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/

someone figured out why ubuntu hardy does NOT require auth to add rss subscriptions (cupsd dies completely when visiting "evil" page), whereas ubuntu intrepid DOES require auth.

copied and pasted:

"
TH responds:

Problem solved:

Hardy’s version: 1.3.7-1ubuntu3.1
Intrepid’s version: 1.3.9-2
http://packages.ubuntu.com/intrepid/cups
http://packages.ubuntu.com/hardy/cupsys

From cups-1.3.8 CHANGES.txt:
- The scheduler now ensures that the RSS directory has the correct permissions.
"

hope that helps.

[Jan (jan-redhat-bugs)]

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5183 to
the following vulnerability:

cupsd in CUPS before 1.3.8 allows local users, and possibly remote
attackers, to cause a denial of service (daemon crash) by adding a
large number of RSS Subscriptions, which triggers a NULL pointer
dereference. NOTE: this issue can be triggered remotely by leveraging
CVE-2008-5184.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5183
http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/298241
http://www.openwall.com/lists/oss-security/2008/11/19/3
http://www.openwall.com/lists/oss-security/2008/11/19/4

Patch: See attachment -- cups-1.3-max-subscriptions.patch

[Martin Pitt (pitti)]

CVE-2008-5183
CVE-2008-5184

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-4.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/cups-1.3.9-4.fc10

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-2.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/cups-1.3.9-2.fc9

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-2.fc8 has been submitted as an update for Fedora 8.
http://admin.fedoraproject.org/updates/cups-1.3.9-2.fc8

[Kees Cook (kees)]

Is CVE-2008-5183 fixed upstream yet?

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-4.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.

[Fedora (fedora-redhat-bugs)]

cups-1.3.9-2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.

[Martin Pitt (pitti)]

This is fixed in >= 1.3.8 and only affects >= 1.3, thus it is not an issue for intrepid, jaunty, and dapper.

[Martin Pitt (pitti)]

http://www.cups.org/str.php?L2774 has a patch for CVE-2008-5184.

CVE-2008-5183 is not fixed anywhere, not even latest upstream. However, it is just an authenticated local DoS, and thus very low-priority.

[Martin Pitt (pitti)]

RedHat has a patch for CVE-2008-5183, linked bug.

[Marc Deslauriers (mdeslaur)]

This issue was fixed for Dapper, Gutsy, Hardy and Intrepid by:

http://www.ubuntu.com/usn/usn-707-1

[Tomas (tomas-redhat-bugs)]

https://www.redhat.com/security/data/cve/CVE-2008-5183.html

[Vincent (vincent-redhat-bugs)]

This was addressed via:

Red Hat Enterprise Linux version 5 (RHSA-2008:1029)