Attachment 14908 Details for Bug 47317

discussion

cups-dos.txt (text/plain), 5.55 KB, created by Thomas Biege on 2003-10-14 23:24:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2003-10-14 23:24:54 UTC

Size: 5.55 KB

patch

obsolete

>From mjc@redhat.com Tue Oct 14 17:21:11 2003
>Date: Fri, 3 Oct 2003 10:03:41 +0100 (BST)
>From: Mark J Cox <mjc@redhat.com>
>To: Michael Sweet <mike@easysw.com>
>Cc: vendor-sec@lst.de, twaugh@redhat.com
>Subject: [vendor-sec] Issue in CUPS with security consequences
>
>Red Hat has had an issue reported to us that affects CUPS 1.1.17, see
>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=97958
>
>	"A situation that could give rise to a busy loop has been
>	identified in the libcups library. Programs that link to the
>	library (such as lpstat and even the CUPS spooler itself) may hang 
>	intermittently."
>
>Tim Waugh developed a patch:
>
>	http://bugzilla.redhat.com/bugzilla/attachment.cgi?id=94115&action=view
>
>In order to exploit this bug, an attacker would need the ability to make a
>TCP connection to the IPP port.
>
>I've assigned CAN-2003-0788 for this issue.  
>
>	The Common Vulnerabilities and Exposures project (cve.mitre.org) 
>	has assigned the name CAN-2003-0788 to this issue.
>
>Since this issue is already public (due to the bugzilla entry being around
>for a while) we had intended to release a security errata for our
>customers next week; please let us know if you'd prefer otherwise.
>
>Thanks, Mark
>-- 
>Mark J Cox / Red Hat Security Response Team
>
>
>
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From mike@easysw.com Tue Oct 14 17:21:15 2003
>Date: Fri, 03 Oct 2003 10:36:06 -0400
>From: Michael Sweet <mike@easysw.com>
>To: Mark J Cox <mjc@redhat.com>
>Cc: vendor-sec@lst.de, twaugh@redhat.com
>Subject: [vendor-sec] Re: Issue in CUPS with security consequences
>
>Mark J Cox wrote:
>> Red Hat has had an issue reported to us that affects CUPS 1.1.17, see
>> http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=97958
>> 
>> 	"A situation that could give rise to a busy loop has been
>> 	identified in the libcups library. Programs that link to the
>> 	library (such as lpstat and even the CUPS spooler itself) may hang 
>> 	intermittently."
>> 
>> Tim Waugh developed a patch:
>> 
>> 	http://bugzilla.redhat.com/bugzilla/attachment.cgi?id=94115&action=view
>
>The patch does not appear to be correct, and might cause other
>problems by incorrectly returning -1 from httpRead().  The fix we
>added for a similar problem prior to 1.1.19's release was a read
>timeout combined with some other error checks...
>
>I believe that the current release (1.1.19) is not vulnerable to
>this problem, however we'll need to do more investigation to be sure.
>Please file a STR at:
>
>     http://www.cups.org/str.php
>
>so that we can track this problem.  Without the STR, we can't do
>anything for you...
>
>> ...
>> Since this issue is already public (due to the bugzilla entry being around
>> for a while) we had intended to release a security errata for our
>> customers next week; please let us know if you'd prefer otherwise.
>
>That's fine with me - I think you are the only distro using 1.1.17.
>
>-- 
>______________________________________________________________________
>Michael Sweet, Easy Software Products           mike at easysw dot com
>Printing Software for UNIX                       http://www.easysw.com
>
>
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From ademar@conectiva.com.br Tue Oct 14 17:21:19 2003
>Date: Fri, 3 Oct 2003 11:51:52 -0300
>From: Ademar de Souza Reis Jr. <ademar@conectiva.com.br>
>To: Mark J Cox <mjc@redhat.com>
>Cc: Michael Sweet <mike@easysw.com>, vendor-sec@lst.de, twaugh@redhat.com
>Subject: Re: [vendor-sec] Issue in CUPS with security consequences
>
>Hi.
>
>Any idea if it affects another versions?
>(We ship cups 1.1.14 and 1.1.18).
>
>Thanks,
>   - Ademar
>
>On Fri, Oct 03, 2003 at 10:03:41AM +0100, Mark J Cox wrote:
>> Red Hat has had an issue reported to us that affects CUPS 1.1.17, see
>> http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=97958
>> 
>> 	"A situation that could give rise to a busy loop has been
>> 	identified in the libcups library. Programs that link to the
>> 	library (such as lpstat and even the CUPS spooler itself) may hang 
>> 	intermittently."
>> 
>> Tim Waugh developed a patch:
>> 
>> 	http://bugzilla.redhat.com/bugzilla/attachment.cgi?id=94115&action=view
>> 
>> In order to exploit this bug, an attacker would need the ability to make a
>> TCP connection to the IPP port.
>> 
>> I've assigned CAN-2003-0788 for this issue.  
>
>-- 
>Ademar de Souza Reis Jr. <ademar@conectiva.com.br>
>
>^[:wq!
>
>    [ Part 2, Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From mike@easysw.com Tue Oct 14 17:21:22 2003
>Date: Fri, 03 Oct 2003 10:57:33 -0400
>From: Michael Sweet <mike@easysw.com>
>To: Ademar de Souza Reis Jr. <ademar@conectiva.com.br>
>Cc: Mark J Cox <mjc@redhat.com>, vendor-sec@lst.de, twaugh@redhat.com
>Subject: Re: [vendor-sec] Issue in CUPS with security consequences
>
>Ademar de Souza Reis Jr. wrote:
>> Hi.
>> 
>> Any idea if it affects another versions?
>> (We ship cups 1.1.14 and 1.1.18).
> > ...
>
>If I understand the reported problem, it will affect all versions
>of CUPS up to 1.1.19.
>
>It would be useful for all interested parties to test 1.1.20rc2,
>so that any security issues in the 1.1.20 release can be addressed
>BEFORE it is released... :)
>
>-- 
>______________________________________________________________________
>Michael Sweet, Easy Software Products           mike at easysw dot com
>Printing Software for UNIX                       http://www.easysw.com
>
>
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View

Attachments on bug 47317: 14908 | 14909 | 14910 | 15216