Red Hat Bugzilla – Bug 1091568
CVE-2014-4338 cups-filters: unsupported BrowseAllow value lets cups-browsed accept from all hosts
Last modified: 2015-11-25 05:14:29 EST
A flaw in cups-filters was fixed upstream  and is described as follows:
cups-browsed: SECURITY FIX: Fix on usage of the "BrowseAllow" directive in cups-browsed.conf. Before, if the argument of a "BrowseAllow" directive is not understood it is treated as the directive not having been there, allowing any host if this was the only "BrowseAllow" directive. Now we treat this as a directive which no host can fulfill, not allowing any host if it was the only one. No "BrowseAllow" directive means access for all, as before ().
Created cups-filters tracking bugs for this issue:
Affects: fedora-all [bug 1091569]
cups-filters-1.0.53-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
cups-filters-1.0.53-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
MITRE assigned CVE-2014-4338 to this issue:
A flaw was found in the way the cups-browsed daemon interpreted the "BrowseAllow" directive in the cups-browsed.conf file. An attacker able to add a malformed "BrowseAllow" directive to the cups-browsed.conf file could use this flaw to bypass intended access restrictions.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2014:1795 https://rhn.redhat.com/errata/RHSA-2014-1795.html