Security Features in CUPS - CVE-2015-1158
Published: June 26, 2015 / Updated: July 29, 2020
Vulnerability identifier: #VU32416
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-1158
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Affected software
CUPS
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
Fedora
cups (Alpine package)
cups
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
Fedora
cups (Alpine package)
cups
How to mitigate CVE-2015-1158
Install update from vendor's website.
CUPS - update to 2.0.3
cups (Alpine package) - update to 1.7.4-r2
cups - addressed in versions 1.7.5-17.fc21, 2.0.3-1.fc22
cups (Alpine package) - update to 1.7.4-r2
cups - addressed in versions 1.7.5-17.fc21, 2.0.3-1.fc22
Links to Public Exploits and PoC-codes
External References
- http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html
- http://rhn.redhat.com/errata/RHSA-2015-1123.html
- http://www.cups.org/blog.php?L1082
- http://www.debian.org/security/2015/dsa-3283
- http://www.kb.cert.org/vuls/id/810572
- http://www.securityfocus.com/bid/75098
- http://www.securitytracker.com/id/1032556
- http://www.ubuntu.com/usn/USN-2629-1
- https://bugzilla.opensuse.org/show_bug.cgi?id=924208
- https://bugzilla.redhat.com/show_bug.cgi?id=1221641
- https://code.google.com/p/google-security-research/issues/detail?id=455
- https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py
- https://security.gentoo.org/glsa/201510-07
- https://www.cups.org/str.php?L4609
- https://www.exploit-db.com/exploits/37336/
- https://www.exploit-db.com/exploits/41233/