CVE-2008-1373: CUPS GIF image filter overflow

[Martin Pitt]

Binary package hint: cupsys

cupsys 1.3.7 fixes a security vulnerability in cupsd, which applies to stables as well. Please see http://www.cups.org/str.php?L2765 for details and the patch.

[Tomas (tomas-redhat-bugs)]

It was discovered that GIF parsing code used by CUPS printing system is affected
by similar issue as GIF parsers used by gd / netpbm / tk / SDL_image.

Value of code_size read from GIF image is not properly validate before being
used to initialize table array in gif_read_lzw(), causing a static buffer overflow.

Issue is similar to:
CVE-2006-4484 (gd), CVE-2007-6697 (SDL_image), CVE-2008-0553 (tk), CVE-2008-0554
(netpbm)

[Tomas (tomas-redhat-bugs)]

Created attachment 298680
Proposed patch

Similar to fixed used in gd / tk / netpbm / SDL_image.

[Tomas (tomas-redhat-bugs)]

Tracked upstream via: http://www.cups.org/str.php?L2765

[rbu (rbu-gentoo-bugs)]

Tomas Hoger writes:
Value of code_size is read from GIF image, but not properly validated
before use to initialize table array in gif_read_lzw(). clear_code
used as upper bound in for loop is short, hence overflow is limited to
~16k - 4k short int values. Moreover, attacker has limited control
over the values written past the end of the buffer.

[rbu (rbu-gentoo-bugs)]

Timo, this issue is under embargo until 2008-03-26. Do not commit anything to CVS until this date. Please prepare an updated ebuild and attach it to this bug, we will do prestable testing here. Thanks.

[rbu (rbu-gentoo-bugs)]

Created attachment 146667
cups-1.2.12-CVE-2008-1373.patch

[rbu (rbu-gentoo-bugs)]

Created attachment 146668
cups-1.3.6-CVE-2008-1373.patch

[tgurr (tgurr-gentoo-bugs)]

Created attachment 146714
cups-1.2.12-r7.ebuild

Added the patch for CVE-2008-1373 and also removed the unneeded (as also discussed per mail and with upstream) patch for CVE-2007-4045.

[tgurr (tgurr-gentoo-bugs)]

Created attachment 146721
cups-1.3.6-r3.ebuild

[rbu (rbu-gentoo-bugs)]

Arch Security Liaisons, please test the attached ebuild and report it stable on this bug.
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 release s390 sh sparc x86"

CC'ing current Liaisons:
   alpha : ferdy
   amd64 : welp
    hppa : jer
     ppc : dertobi123
   ppc64 : corsair
 release : pva
   sparc : fmccor
     x86 : opfer

[rbu (rbu-gentoo-bugs)]

(In reply to comment #6)
> Arch Security Liaisons, please test the attached ebuild and report it stable on
> this bug.

That is:
=net-print/cups-1.2.12-r7

[fauli (fauli-gentoo-bugs)]

Good to go on x86

[fmccor (fmccor-gentoo-bugs)]

Looks good on sparc. Tested -1.2.12-r7, remote only, with {.ps, .pdf} files.

[jer (jer-gentoo-bugs)]

HPPA is OK.

[corsair (corsair-gentoo-bugs)]

looks good on ppc64

[dertobi123 (dertobi123-gentoo-bugs)]

looks good on ppc

[armin76 (armin76-gentoo-bugs)]

Adding Tobias for alpha

[klausman (klausman-gentoo-bugs)]

=net-print/cups-1.2.12-r7 works dandy on alpha.

[rbu (rbu-gentoo-bugs)]

Created attachment 147078
cups-1.2.12-CVE-2008-0053.patch

[rbu (rbu-gentoo-bugs)]

Created attachment 147080
cups-1.2.12-r7.ebuild

Ok, cups is killing me these days. Could you please retest with the new -r7 ebuild? Thanks.

[rbu (rbu-gentoo-bugs)]

CVE-2008-0053 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0053):
  Unspecified vulnerability in CUPS before 1.3.6 in Apple Mac OS X 10.5.2 has
  unknown impact and attack vectors related to "input validation."

Apple Advisory:
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

Impact: Multiple vulnerabilities in CUPS may lead to an unexpected
application termination or arbitrary code execution with system
privileges
Description: Multiple input validation issues exist in CUPS, the
most serious of which may lead to arbitrary code execution with
system privileges. This update addresses the issues by updating to
CUPS 1.3.6. These issues do not affect systems prior to Mac OS X
v10.5.

Tomas Hoger writes:
According to upstream, this CVE id was allocated for following issue fixed in
CUPS 1.3.6 (see CHANGES.txt):

- Fixed two overflow bugs in the HP-GL/2 filter (Coverity)

[fauli (fauli-gentoo-bugs)]

Local printing ....ok
Remote printing from
  Windows ...ok
  Linux ...ok

x86 good to go...again.

[fmccor (fmccor-gentoo-bugs)]

sparc still looks good, too, as described in Comment 9.

[corsair (corsair-gentoo-bugs)]

looks good on ppc64, too.

[jer (jer-gentoo-bugs)]

HPPA is OK again.

[klausman (klausman-gentoo-bugs)]

And on alpha, it works, too.

[dertobi123 (dertobi123-gentoo-bugs)]

still looks good for ppc

[rbu (rbu-gentoo-bugs)]

Please note that the embargo has been delayed until Monday, 03/31.

[corsair (corsair-gentoo-bugs)]

looks good on ppc64

[rbu (rbu-gentoo-bugs)]

(In reply to comment #24)
> Please note that the embargo has been delayed until Monday, 03/31.

.... and again, Tuesday it is.

[rbu (rbu-gentoo-bugs)]

This is public now. Printing, please commit with the keywords you gathered.

[Fedora (fedora-redhat-bugs)]

cups-1.2.12-10.fc7 has been submitted as an update for Fedora 7

[rbu (rbu-gentoo-bugs)]

Arches, please test and mark stable:
=net-print/cups-1.2.12-r7
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 release s390 sh sparc x86"
Already stabled : "alpha amd64 hppa ppc ppc64 sparc x86"
Missing keywords: "arm ia64 m68k release s390 sh"

[rbu (rbu-gentoo-bugs)]

1.3.6 is unaffected for CVE-2008-0053.

This is GLSA-200804-01 - no joke!

[Martin Pitt (pitti)]

Preparing Hardy upload ATM.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cupsys - 1.3.7-1ubuntu1

---------------
cupsys (1.3.7-1ubuntu1) hardy; urgency=low

  * Merge new upstream bug fix release from unstable.
    - Fixes CUPS GIF image filter overflow [CVE-2008-1373]. (LP: #210718)

cupsys (1.3.7-1) unstable; urgency=medium

  * Urgency medium due to security fix.
  * New upstream bugfix/security update release. For a detailled list of
    changes see http://www.cups.org/articles.php?L537.
    - CUPS GIF image filter overflow [CVE-2008-1373, STR #2765].
  * Drop patches which are now upstream:
    - cgiCompileSearch_buffer_overflow.dpatch
    - testsuite-exit-code.dpatch
    - pbmprint.dpatch
  * search_mime_files_in_usr_share.dpatch: Drop log message about missing
    /usr/share/cups/mime/ from error to info, since it is not really an
    error, and causing the test suite to fail due to error log count mismatch.
  * pdftops-cups-1.4.dpatch: Apply r7391 from SVN head to fix missing error
    message newlines (STR #2743).
  * debian/rules: Remove cleaning of test suite HTML reports in test/, they
    are written to /tmp now.
  * Add pdftops-wait-eintr.dpatch: Handle EINTR in pdftops' wait() call.
    (Caught by test suite.)
  * debian/libcupsys2-dev.files: Drop i18n.h, it's an internal interface and
    not installed by upstream any more.
  * debian/control: Add poppler-utils | xpdf-utils build dependency, so that
    the test suite works during build.

 -- Martin Pitt <email address hidden> Wed, 02 Apr 2008 11:16:39 +0200

[pva (pva-gentoo-bugs)]

Stable on ia64 by armin76.
Fixed in release snapshot.

[rbu (rbu-gentoo-bugs)]

*** Bug 215863 has been marked as a duplicate of this bug. ***

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-598-1

[Fedora (fedora-redhat-bugs)]

cups-1.3.6-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.

[Fedora (fedora-redhat-bugs)]

cups-1.2.12-10.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.

[Red (red-redhat-bugs)]

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0192.html
  http://rhn.redhat.com/errata/RHSA-2008-0206.html

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-2897
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-2131