CUPS - Invalid Username Crash Vulnerability
Summary
DLA-1387-1: cups - security update. Affects cups versions < 1.5.3-5+deb7u8. Fixed in 1.5.3-5+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CUPS (Common UNIX Printing System) is a printing system for Unix-like operating systems that allows users to print files from a computer to a printer. It provides a portable printing layer for various operating systems and supports a wide range of printers and print services. The CUPS server, when configured with D-Bus support, is vulnerable to a crash when an invalid username is submitted with a print job.
Vulnerability Detail
The vulnerability, identified as CVE-2017-18248, occurs due to a flaw in the CUPS server's handling of print jobs with invalid usernames. When D-Bus support is enabled (as is the case for Debian), an attacker can exploit this vulnerability by submitting a print job with an invalid username. This can lead to a crash of the CUPS server, impacting the availability of printing services. The vulnerability has been fixed in version 1.5.3-5+deb7u8 of the CUPS package for Debian 7 Wheezy.
How To Fix
Minimum fixed version
1.5.3-5+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CUPS package in Debian 7 Wheezy is vulnerable to a crash when an invalid username is submitted with a print job. To mitigate this vulnerability, it is recommended to upgrade the CUPS package to version 1.5.3-5+deb7u8 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cups →
FAQ
CUPS (Common UNIX Printing System) is a printing system for Unix-like operating systems that allows users to print files from a computer to a printer.
D-Bus is a message bus system that enables communication between applications running on the same machine or across a network. It is used by CUPS for inter-process communication.
An attacker can exploit this vulnerability by submitting a print job with an invalid username to the CUPS server when D-Bus support is enabled. This can cause the server to crash.
The vulnerability can lead to a crash of the CUPS server, impacting the availability of printing services. This can result in disruption of printing operations for affected systems.
Yes, the vulnerability has been fixed in version 1.5.3-5+deb7u8 of the CUPS package for Debian 7 Wheezy.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
