Impact: Visiting a maliciously crafted website while logged into the CUPS
web interface as an administrator may lead to CUPS being reconfigured
Description: A cross-site request forgery issue exists in the CUPS web
interface. Visiting a maliciously crafted website while logged into the
CUPS web interface as an administrator may lead to CUPS being reconfigured.
This issue is addressed by requiring web form submissions to include an
unpredictable session token. Credit to Adrian 'pagvac' Pastor of
GNUCITIZEN, and Tim Starling for reporting this issue.
The CUPS web interface allows you to edit cupsd.conf and manipulate print
queues and jobs. If an authenticated administrator visits an attacker's
website, the attacker can disable the cupsd process (denial of service),
change the cupsd configuration to allow for remote and/or unauthenticated
access, access print jobs and other system files, overwrite system files,
redirect print jobs to different destinations, and so forth.
All versions of CUPS since 1.1.0 are vulnerable to this kind of attack,
although remote configuration of cupsd.conf was not introduced until CUPS
This issue is fixed in CUPS 1.4.4.
Created attachment 411332 [details]
Upstream 1.3 patch
Created attachment 411333 [details]
Upstream 1.4 patch
Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters.
This is now public via http://support.apple.com/kb/HT4188
Created attachment 424369 [details]
Cancel RSS subscription regression fix
Ubuntu reported that 1.4 patch contains a regression, that breaks "Cancel RSS subscription" action on admin page. Patch should be included in 1.4.4 final.
Created cups tracking bugs for this issue
Affects: fedora-all [bug 605399]
This issue has been addressed in following products:
Red Hat Enterprise Linux 3
Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.