During the process of CUPS socket activation code refactoring in favour of systemd capability a security flaw was found in the way CUPS service honoured Listen localhost:631 cupsd.conf configuration option. The setting was recognized properly for IPv4-enabled systems, but failed to be correctly applied for IPv6-enabled systems. As a result, a remote attacker could use this flaw to obtain (unauthorized) access to the CUPS web-based administration interface. References: [1] https://bugzilla.novell.com/show_bug.cgi?id=795624
This issue did NOT affect the versions of the cups package, as shipped with Red Hat Enterprise Linux 5 and 6 as they did not use systemd capability for CUPS socket activation yet. -- This issue affects the versions of the cups package, as shipped with Fedora release of 16 and 17. Please schedule an update.
Created cups tracking bugs for this issue Affects: fedora-all [bug 891945]
CVE Request: http://www.openwall.com/lists/oss-security/2013/01/04/1
Statement: Not vulnerable. This issue did not affect the versions of cups as shipped with Red Hat Enterprise Linux 5 and 6 as they did not use the systemd capability for CUPS socket activation yet.
This was assigned CVE-2012-6094: http://www.openwall.com/lists/oss-security/2013/01/04/5
cups-1.5.4-18.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.