Bug 588805 - (CVE-2010-0540) CVE-2010-0540 CUPS administrator web interface CSRF
CVE-2010-0540 CUPS administrator web interface CSRF
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20100615,reported=20100430,sou...
: Security
Depends On: 590081 590082 590083 590084 590085 590086 605399
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-04 12:33 EDT by Josh Bressers
Modified: 2016-03-04 07:04 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-07-27 01:25:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Upstream 1.3 patch (98.86 KB, patch)
2010-05-04 12:53 EDT, Josh Bressers
no flags Details | Diff
Upstream 1.4 patch (195.20 KB, patch)
2010-05-04 12:53 EDT, Josh Bressers
no flags Details | Diff
Cancel RSS subscription regression fix (1.20 KB, patch)
2010-06-16 03:24 EDT, Tomas Hoger
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
CUPS Bugs and Features 3498 None None None Never

  None (edit)
Description Josh Bressers 2010-05-04 12:33:36 EDT
Impact: Visiting a maliciously crafted website while logged into the CUPS
web interface as an administrator may lead to CUPS being reconfigured

Description: A cross-site request forgery issue exists in the CUPS web
interface. Visiting a maliciously crafted website while logged into the
CUPS web interface as an administrator may lead to CUPS being reconfigured.
This issue is addressed by requiring web form submissions to include an
unpredictable session token. Credit to Adrian 'pagvac' Pastor of
GNUCITIZEN, and Tim Starling for reporting this issue.
----------------------

The CUPS web interface allows you to edit cupsd.conf and manipulate print
queues and jobs. If an authenticated administrator visits an attacker's
website, the attacker can disable the cupsd process (denial of service),
change the cupsd configuration to allow for remote and/or unauthenticated
access, access print jobs and other system files, overwrite system files,
redirect print jobs to different destinations, and so forth.  

All versions of CUPS since 1.1.0 are vulnerable to this kind of attack,
although remote configuration of cupsd.conf was not introduced until CUPS
1.2.0.
This issue is fixed in CUPS 1.4.4.
Comment 2 Josh Bressers 2010-05-04 12:53:05 EDT
Created attachment 411332 [details]
Upstream 1.3 patch
Comment 3 Josh Bressers 2010-05-04 12:53:35 EDT
Created attachment 411333 [details]
Upstream 1.4 patch
Comment 16 Vincent Danen 2010-05-25 19:39:01 EDT
Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters.
Comment 35 Vincent Danen 2010-06-15 18:15:21 EDT
This is now public via http://support.apple.com/kb/HT4188
Comment 36 Tomas Hoger 2010-06-16 03:24:58 EDT
Created attachment 424369 [details]
Cancel RSS subscription regression fix

Ubuntu reported that 1.4 patch contains a regression, that breaks "Cancel RSS subscription" action on admin page.  Patch should be included in 1.4.4 final.
Comment 38 Vincent Danen 2010-06-17 16:39:16 EDT
Created cups tracking bugs for this issue

Affects: fedora-all [bug 605399]
Comment 39 errata-xmlrpc 2010-06-17 18:18:53 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html
Comment 40 Fedora Update System 2010-06-18 07:03:34 EDT
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13
Comment 41 Fedora Update System 2010-06-18 07:04:28 EDT
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12
Comment 42 Fedora Update System 2010-06-18 07:05:33 EDT
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11
Comment 43 Fedora Update System 2010-06-24 08:22:46 EDT
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13
Comment 44 Fedora Update System 2010-06-25 14:10:38 EDT
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 45 Fedora Update System 2010-07-01 14:44:33 EDT
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 46 Fedora Update System 2010-07-26 22:46:00 EDT
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.