Bugzilla Bug 238976

** Please note that this issue is confidential and no information should be
disclosed until it is made public, see "Whiteboard" for a date **

David Remahl wrote:
Apple has been notified of three vulnerabilities in CUPS (Common Unix  
Printing System). They are described below along with their Apple- 
assigned CVEs and CUPS STRs (restricted from public view).

1. imagetops heap-based buffer overflow (CVE-2008-3639, CUPS STR #2918)

A heap-based buffer overflow issue exists within the read_rle16()  
function of the imagetops CUPS image filter. The row count is not  
properly validated, and is used to control how many 16-bit integers  
are stored in a heap-based buffer.

Credit: “regenrecht” working with iDefense

2. texttops integer overflow (CVE-2008-3640, CUPS STR #2919)

An integer overflow issue exists within the WriteProlog() function in  
the texttops CUPS image filter. When calculating the page size for  
storing PostScript data, values are derived from user content and are  
used in multiplication. If the operation overflows, a small  
destination buffer may be allocated, resulting in a heap-based buffer  
overflow.

Credit: “regenrecht” working with iDefense


3. hpgltops write-what-where (CVE-2008-3641, CUPS STR #2911)

An unchecked index issue exists within the PW_pen_width() and  
PC_pen_color() functions in the hpgltops CUPS image filter. Buffer  
bounds are not properly validated when handling the pen width and pen  
color opcodes, potentially resulting in arbitrary memory being  
overwritten with controlled data.

Credit: “regenrecht” working with TippingPoint

Created an attachment (id=166712) [details]
cups-1.3.8-CVE-2008-3639.patch

Created an attachment (id=166713) [details]
cups-1.3.8-CVE-2008-3640.patch

Created an attachment (id=166715) [details]
cups-1.3.8-CVE-2008-3641.patch

The last two patches don't apply to 1.2.12 -- if we want to push a new stable,
we need to do some backporting of the patches.

Created an attachment (id=167039) [details]
cups-1.3.8-r2-overlay.tar.gz

overlay containing cups-1.3.8-r2 and the patches

Arch Security Liaisons, please test the attached ebuild and report it stable on
this bug.

=net-print/cups-1.3.8-r2
Target keywords : "alpha amd64 hppa ia64 ppc ppc64 sparc x86"

CC'ing current Liaisons:
   alpha : yoswink, armin76
   amd64 : keytoaster, tester
    hppa : jer
     ppc : dertobi123
   ppc64 : corsair
   sparc : fmccor
     x86 : maekke, armin76

(From update of attachment 167039 [details])
Um, sorry. I am suddenly not quite sure anymore that I was doing the right
thing there. Opera messes with compression sometimes.

HPPA is OK.

(From update of attachment 167039 [details])
You're right, it is tar only. I forgot the z parameter.

amd64 OK

Sparc stable.  My test is network only, using {.pdf, .ps} files and two
printers:
HP --- HP_4_SI_MX
Xerox: DocuPrint_N2125 (with duplexer unit)

Adding Tobias for alpha

looks good on amd64/x86

looks good on ppc, too

looks good on ppc64.

public now, please commit.

Thanks everyone, I've commited cups-1.3.8-r2 with stable keywords: amd64 hppa
ppc ppc64 sparc x86
I've also sneaked in a little upstream patch to fix the broken desktop file
(bug #236706) with -r2.

On a last note, I've also followed rbu's advice on how to handle our insecure
1.2.12 revisions and removed the keywords of non-slacker archs with this
commit.

Arches, please test and mark stable:
=net-print/cups-1.3.8-r2
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
Already stabled : "amd64 hppa ppc ppc64 sparc x86"
Missing keywords: "alpha arm ia64 m68k s390 sh"

CVE-2008-3639 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3639):
  Heap-based buffer overflow in the read_rle16 function in imagetops in
  CUPS before 1.3.9 allows remote attackers to execute arbitrary code
  via an SGI image with malformed Run Length Encoded (RLE) data
  containing a small image and a large row count.

CVE-2008-3640 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3640):
  Integer overflow in the WriteProlog function in texttops in CUPS
  before 1.3.9 allows remote attackers to execute arbitrary code via a
  crafted PostScript file that triggers a heap-based buffer overflow.

Stable on alpha.

Please be sure to delete and redownload the cups tarball if you've already
downloaded it before, since upstream seems to have changed it some time ago,
see bug #241216.

ia64 stable, everything else is done

GLSA request has been filed (rbu).

GLSA 200812-11