Bug 588805 (CVE-2010-0540) - CVE-2010-0540 CUPS administrator web interface CSRF
Summary: CVE-2010-0540 CUPS administrator web interface CSRF
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0540
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 590081 590082 590083 590084 590085 590086 605399
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-05-04 16:33 UTC by Josh Bressers
Modified: 2019-09-29 12:36 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-07-27 05:25:47 UTC


Attachments (Terms of Use)
Upstream 1.3 patch (98.86 KB, patch)
2010-05-04 16:53 UTC, Josh Bressers
no flags Details | Diff
Upstream 1.4 patch (195.20 KB, patch)
2010-05-04 16:53 UTC, Josh Bressers
no flags Details | Diff
Cancel RSS subscription regression fix (1.20 KB, patch)
2010-06-16 07:24 UTC, Tomas Hoger
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
CUPS Bugs and Features 3498 None None None Never
Red Hat Product Errata RHSA-2010:0490 normal SHIPPED_LIVE Important: cups security update 2010-06-17 22:18:30 UTC

Description Josh Bressers 2010-05-04 16:33:36 UTC
Impact: Visiting a maliciously crafted website while logged into the CUPS
web interface as an administrator may lead to CUPS being reconfigured

Description: A cross-site request forgery issue exists in the CUPS web
interface. Visiting a maliciously crafted website while logged into the
CUPS web interface as an administrator may lead to CUPS being reconfigured.
This issue is addressed by requiring web form submissions to include an
unpredictable session token. Credit to Adrian 'pagvac' Pastor of
GNUCITIZEN, and Tim Starling for reporting this issue.
----------------------

The CUPS web interface allows you to edit cupsd.conf and manipulate print
queues and jobs. If an authenticated administrator visits an attacker's
website, the attacker can disable the cupsd process (denial of service),
change the cupsd configuration to allow for remote and/or unauthenticated
access, access print jobs and other system files, overwrite system files,
redirect print jobs to different destinations, and so forth.  

All versions of CUPS since 1.1.0 are vulnerable to this kind of attack,
although remote configuration of cupsd.conf was not introduced until CUPS
1.2.0.
This issue is fixed in CUPS 1.4.4.

Comment 2 Josh Bressers 2010-05-04 16:53:05 UTC
Created attachment 411332 [details]
Upstream 1.3 patch

Comment 3 Josh Bressers 2010-05-04 16:53:35 UTC
Created attachment 411333 [details]
Upstream 1.4 patch

Comment 16 Vincent Danen 2010-05-25 23:39:01 UTC
Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters.

Comment 35 Vincent Danen 2010-06-15 22:15:21 UTC
This is now public via http://support.apple.com/kb/HT4188

Comment 36 Tomas Hoger 2010-06-16 07:24:58 UTC
Created attachment 424369 [details]
Cancel RSS subscription regression fix

Ubuntu reported that 1.4 patch contains a regression, that breaks "Cancel RSS subscription" action on admin page.  Patch should be included in 1.4.4 final.

Comment 38 Vincent Danen 2010-06-17 20:39:16 UTC
Created cups tracking bugs for this issue

Affects: fedora-all [bug 605399]

Comment 39 errata-xmlrpc 2010-06-17 22:18:53 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html

Comment 40 Fedora Update System 2010-06-18 11:03:34 UTC
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13

Comment 41 Fedora Update System 2010-06-18 11:04:28 UTC
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12

Comment 42 Fedora Update System 2010-06-18 11:05:33 UTC
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11

Comment 43 Fedora Update System 2010-06-24 12:22:46 UTC
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13

Comment 44 Fedora Update System 2010-06-25 18:10:38 UTC
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 45 Fedora Update System 2010-07-01 18:44:33 UTC
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 46 Fedora Update System 2010-07-27 02:46:00 UTC
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.