Stack-based buffer overflow in cups - #VU155773

Vulnerability details

The vulnerability allows a remote privileged user on the local network to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in backendSNMPSupplies() in the CUPS network backends when formatting marker-levels from printer-supplied SNMP replies. A remote privileged user on the local network can supply crafted SNMP replies containing supply levels and maximum capacities that produce oversized percentage values to cause a denial of service.

Exploitation requires an existing classic driver or vendor-PPD queue using socket://, lpd:// or ipp:// with SNMP supply polling enabled. IPP Everywhere and raw queues are not affected. Spoofed replies must reach the backend's ephemeral UDP port while it polls.

Affected software

Remediation

External References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-5cpc-rwrw-jp83

Related Security Bulletins

• Multiple vulnerabilities in cups