Improper restriction of communication channel to intended endpoints in cups - #VU155775

Vulnerability details

The vulnerability allows a local user to disclose the root administrator certificate token.

The vulnerability exists due to missing peer identity verification in cups/auth.c:cups_do_local_auth when handling local authentication challenges over Unix domain sockets. A local user can send a crafted local printer creation request and return a 401 authentication challenge from a controlled Unix domain socket to disclose the root administrator certificate token.

Exploitation is possible under the default configuration when cupsd runs as root. It requires access to the cupsd domain socket and the ability to listen on a controlled Unix domain socket.

Affected software

Remediation

External References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-8q78-mrwh-rm85

Related Security Bulletins

• Multiple vulnerabilities in cups