Date: Mon, 12 Nov 2018 13:05:42 -0800 (PST)
From: "product-security@apple.com" <product-security@apple.com>
To: odyx@debian.org, till.kamppeter@gmail.com, jsmeix@suse.de,
    zdohnal@redhat.com, korobkin+op@gmail.com, cert@cert.org
Subject: Coordinated disclosure for CUPS security issue; Follow-up: 703576046

Hello,

We would like to inform you of a security issue in CUPS on Linux.

Issue:
==================================================

CUPS generates session cookies as follows in cgi_set_sid():

----------------------------------------
  if ((remote_addr = getenv("REMOTE_ADDR")) == NULL)
    remote_addr = "REMOTE_ADDR";
  if ((server_name = getenv("SERVER_NAME")) == NULL)
    server_name = "SERVER_NAME";
  if ((server_port = getenv("SERVER_PORT")) == NULL)
    server_port = "SERVER_PORT";

  CUPS_SRAND(time(NULL));
  snprintf(buffer, sizeof(buffer), "%s:%s:%s:%02X%02X%02X%02X%02X%02X%02X%02X",
           remote_addr, server_name, server_port,
           (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
           (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
           (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
           (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255);
       cupsHashData("md5", (unsigned char *)buffer, strlen(buffer), sum, sizeof(sum));

cgiSetCookie(CUPS_SID, cupsHashString(sum, sizeof(sum), sid, sizeof(sid)), "/", NULL, 0, 0);
----------------------------------------

Note the CUPS_SRAND(time(NULL)).
CUPS_SRAND() and CUPS_RAND() have four possible definitions, depending on the environment:

----------------------------------------
#ifdef HAVE_ARC4RANDOM
#  define CUPS_RAND() arc4random()
#  define CUPS_SRAND(v)
#elif defined(HAVE_RANDOM)
#  define CUPS_RAND() random()
#  define CUPS_SRAND(v) srandom(v)
#elif defined(HAVE_LRAND48)
#  define CUPS_RAND() lrand48()
#  define CUPS_SRAND(v) srand48(v)
#else
#  define CUPS_RAND() rand()
#  define CUPS_SRAND(v) srand(v)
#endif /* HAVE_ARC4RANDOM */
----------------------------------------

On a typical Linux system, HAVE_ARC4RANDOM is not defined, but HAVE_RANDOM is defined; so CUPS_RAND() is random(), and CUPS_SRAND() is srandom().

This means that the session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface.

Luckily, this isn't very useful unless the user has already authenticated to CUPS; and because CUPS uses HTTP basic auth for authentication, an attacker can't forcibly sign the user in (e.g. Chrome forbids it completely, Firefox shows a confirmation prompt).

==================================================


Patch:
==================================================
Attached: cups-session-id.patch

diff --git a/cgi-bin/var.c b/cgi-bin/var.c
index 649b65ba..579f23ba 100644
--- a/cgi-bin/var.c
+++ b/cgi-bin/var.c
@@ -1207,6 +1207,7 @@ cgi_set_sid(void)
   const char        *remote_addr,    /* REMOTE_ADDR */
             *server_name,    /* SERVER_NAME */
             *server_port;    /* SERVER_PORT */
+  struct timeval    curtime;    /* Current time */


   if ((remote_addr = getenv("REMOTE_ADDR")) == NULL)
@@ -1216,7 +1217,8 @@ cgi_set_sid(void)
   if ((server_port = getenv("SERVER_PORT")) == NULL)
     server_port = "SERVER_PORT";

-  CUPS_SRAND(time(NULL));
+  gettimeofday(&curtime, NULL);
+  CUPS_SRAND(curtime.tv_sec + curtime.tv_usec);
   snprintf(buffer, sizeof(buffer), "%s:%s:%s:%02X%02X%02X%02X%02X%02X%02X%02X",
            remote_addr, server_name, server_port,
        (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
==================================================


Proposed embargo date, CVE, and credit information:
==================================================
Please use CVE-2018-4700 for this issue and reference the credit as "Jann Horn of Google Project Zero". Since this issue does not affect macOS, Apple will not be publishing a security advisory for this issue.

This issue should remain embargoed until Friday, December 7th, 2018. If there are any problems with this date, please let us know.
==================================================

Best regards,
Deven
Apple Product Security

cups-session-id.patch

diff --git a/cgi-bin/var.c b/cgi-bin/var.c
index 649b65ba..579f23ba 100644
--- a/cgi-bin/var.c
+++ b/cgi-bin/var.c
@@ -1207,6 +1207,7 @@ cgi_set_sid(void)
   const char		*remote_addr,	/* REMOTE_ADDR */
 			*server_name,	/* SERVER_NAME */
 			*server_port;	/* SERVER_PORT */
+  struct timeval	curtime;	/* Current time */


   if ((remote_addr = getenv("REMOTE_ADDR")) == NULL)
@@ -1216,7 +1217,8 @@ cgi_set_sid(void)
   if ((server_port = getenv("SERVER_PORT")) == NULL)
     server_port = "SERVER_PORT";

-  CUPS_SRAND(time(NULL));
+  gettimeofday(&curtime, NULL);
+  CUPS_SRAND(curtime.tv_sec + curtime.tv_usec);
   snprintf(buffer, sizeof(buffer), "%s:%s:%s:%02X%02X%02X%02X%02X%02X%02X%02X",
            remote_addr, server_name, server_port,
 	   (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,