Stack-based buffer overflow in CUPS - CVE-2019-8696

Vulnerability identifier: #VU23040

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8696

CWE-ID: CWE-121

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing SNMP requests within the asn1_get_packed() function in cups/snmp.c. A remote attacker with access to the the SNMP service can send a specially crafted request to the application, trigger a stack-based buffer oveflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

CUPS
cups (Red Hat package)
cups (Alpine package)
cups
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
Juniper Secure Analytics (JSA)
Red Hat OpenShift Container Platform
IBM Qradar SIEM

Install updates from vendor's website.

CUPS - update to 2.2.12
cups (Red Hat package) - addressed in versions 1.6.3-51.el7, 2.2.6-33.el8
cups (Alpine package) - update to 2.2.12-r0
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
cups - addressed in versions 2.2.8-12.fc29, 2.2.12-1.fc30
Red Hat OpenShift Container Platform - update to 4.3.40
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF02

• https://github.com/apple/cups/commit/2c030c7a06e0c2b8227c7e85f5c58dfb339731d0
• https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
• https://github.com/apple/cups/releases/tag/v2.2.12

• OpenSUSE Linux update for cups
• OpenSUSE Linux update for cups
• Multiple vulnerabilities in CUPS
• Red Hat Enterprise Linux 8 update for cups
• Stack-based buffer overflow in cups (Alpine package)
• Red Hat Enterprise Linux 7 update for cups
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 30 update for cups
• Fedora 29 update for cups