Bug 591983 (CVE-2010-1748)

An unitialized memory read issue exists in the CUPS web interface in how it handles form variables.  An attacker with access to the CUPS web interface could possibly read a limited amount of memory from the cupsd process.  In cgi-bin/var.c, when processing form variables that can come from an unauthenticated user, the cgi_initialize_string() function expects a 2-character hex code after the % character.  If the last character of data is the % character, then it will append a mangled version of the nul terminator and one more byte following the end of data to the output.  The loop will continue appending the contents of memory past the end of data to the output, until another nul byte is read.  A GET request will disclose memory from the environment variable list, and a POST request will disclose memory from the heap.

Upstream CUPS 1.4.4 has corrected this flaw.

Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this flaw. Upstream acknowledges Luca Carettoni as the original reporter.