Heap-based buffer overflow in CUPS - CVE-2020-3898

Vulnerability identifier: #VU27341

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3898

CWE-ID: CWE-122

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing files within the ppdFindOption() function in cups. A remote attacker can send specially crafted data to the daemon, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

CUPS
cups (Alpine package)
cups (Ubuntu package)
cups (Red Hat package)
cups
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
IBM Qradar SIEM

Install updates from vendor's website.

CUPS - update to 2.3.3
cups (Ubuntu package) - addressed in versions 2.1.3-4ubuntu0.11, 2.2.7-1ubuntu2.8, 2.2.12-2ubuntu1.1, 2.3.1-9ubuntu1.1
cups (Red Hat package) - update to 2.2.6-38.el8
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
cups - addressed in versions 2.2.12-8.fc30, 2.2.12-8.fc31, 2.3.1-9.fc32
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF02

• https://lists.opensuse.org/opensuse-security-announce/2020-04/msg00040.html
• https://bugzilla.suse.com/show_bug.cgi?id=1168422
• https://www.suse.com/security/cve/CVE-2020-3898.html
• https://github.com/apple/cups/releases/tag/v2.3.3

• OpenSUSE Linux update for cups
• Remote code execution in cups
• Ubuntu update for CUPS
• Heap-based buffer overflow in cups (Alpine package)
• Red Hat Enterprise Linux 8 update for cups
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Fedora 32 update for cups
• Fedora 31 update for cups
• Fedora 30 update for cups