Bugzilla – Bug 680212
VUL-1: cups: denial of service via cupsDoAuthentication when GSSAPI is not enabled
Last modified: 2018-10-19 18:07:52 UTC
is public, from cve db http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2432 The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses. we use --enable-gssapi always, so I think this does not affect our prebuilt packages.
The matching CUPS STR for CVE-2010-2432 is http://cups.org/str.php?L3518 openSUSE 11.4 has cups-1.4.6 which is safe openSUSE 11.3 has cups-1.4.4 which is safe openSUSE 11.2 has cups-1.3.11 SLE11 has cups-1.3.9 SLE10 has cups-1.1.23 SLE9 has cups-1.1.20 We use "./configure ... --enable-gssapi" in cups.spec for openSUSE:11.4 openSUSE:11.3 openSUSE:11.2 SLE11 But we do not use "./configure ... --enable-gssapi" in cups.spec for SLE10 SLE9 http://cups.org/str.php?L3518 reads: ------------------------------------------------------------------------- If cups is compiled without HAVE_GSSAPI and is used with a server that requires authorization, the client gets into an infinite loop. ------------------------------------------------------------------------- As far as I understand this together with comment #0, it means that the server lets the client go into an infinite loop so that the denial of service happens at the client program which the user of the client program could abort. If my understanding is right, I think it is only a minor issue and I like to ask if I should fix it nevertheless for SLE10 and SLE9 or if we may do nothing in this case?
sles9 - unimportant for denial of service issues, no fix required. sles10 - i would put it on the planned update list. I am not sure if the "HAVE_GSSAPI" part of the description is correct after reviewing the code, it seems the endless retries could also happen with HAVE_GSSAPI.
Maintenance-team, please put it on the planned update list.
The SWAMPID for this issue is 42066. This issue was rated as low. Please submit fixed packages until 2011-08-02. Also create a patchinfo file using this link: https://swamp.suse.de/webswamp/wf/42066
Reopened for further processing by the security team.
done
Update released for: cups, cups-client, cups-debuginfo, cups-debugsource, cups-devel, cups-libs, cups-libs-32bit, cups-libs-x86 Products: SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP1 (i386, x86_64) SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1-TERADATA (x86_64) SLES4VMWARE 11-SP1 (i386, x86_64)