Impact: Visiting a maliciously crafted website while logged into the CUPS web interface as an administrator may lead to CUPS being reconfigured Description: A cross-site request forgery issue exists in the CUPS web interface. Visiting a maliciously crafted website while logged into the CUPS web interface as an administrator may lead to CUPS being reconfigured. This issue is addressed by requiring web form submissions to include an unpredictable session token. Credit to Adrian 'pagvac' Pastor of GNUCITIZEN, and Tim Starling for reporting this issue. ---------------------- The CUPS web interface allows you to edit cupsd.conf and manipulate print queues and jobs. If an authenticated administrator visits an attacker's website, the attacker can disable the cupsd process (denial of service), change the cupsd configuration to allow for remote and/or unauthenticated access, access print jobs and other system files, overwrite system files, redirect print jobs to different destinations, and so forth. All versions of CUPS since 1.1.0 are vulnerable to this kind of attack, although remote configuration of cupsd.conf was not introduced until CUPS 1.2.0. This issue is fixed in CUPS 1.4.4.
Created attachment 411332 [details] Upstream 1.3 patch
Created attachment 411333 [details] Upstream 1.4 patch
Acknowledgements: Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters.
This is now public via http://support.apple.com/kb/HT4188
Created attachment 424369 [details] Cancel RSS subscription regression fix Ubuntu reported that 1.4 patch contains a regression, that breaks "Cancel RSS subscription" action on admin page. Patch should be included in 1.4.4 final.
Created cups tracking bugs for this issue Affects: fedora-all [bug 605399]
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.