Input validation error in cups - #VU154065

Vulnerability details

The vulnerability allows a remote user to modify printer queue configuration and disrupt printing.

The vulnerability exists due to improper input validation in the _ppdCreateFromIPP2() function in cups/ppd-cache.c when processing job-presets-supported collection member values from a printer response during driverless queue creation. A remote user can supply a crafted Get-Printer-Attributes response containing unsanitized quotation marks and line breaks to modify printer queue configuration and disrupt printing.

Exploitation requires user interaction to create the queue and control over the printer response, either through a malicious endpoint or a network intermediary. Queue creation requires membership in SystemGroup, which defaults to root and lpadmin. Temporary queues created through IPP_OP_CUPS_CREATE_LOCAL_PRINTER are not affected.

Affected software

Remediation

External References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-fw7q-ww8w-phx8

Related Security Bulletins

• Multiple vulnerabilities in cups