Bug 77023 – net-print/cups: DoS by HTTP request

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thierry Carrez (RETIRED) 2005-01-07 07:07:28 UTC]

I was tipped by amne on IRC and michip on the forums about a Nessus-triggered cupsd DoS.

I narrowed it to the following HTTP request on port 631 : "GET /..X"
You can reproduce it using :
$ echo -e "GET /..A\n" | nc localhost 631

cupsd will hang and use 100% CPU.

It didn't occur with the CUPS 1.1.20 I was using before.

in scheduler/client.c:

  while ((path = strstr(path, "/..")) != NULL)
    if (!path[3] || path[3] == '/')
      return (0);

This was introduced between 1.1.20 and 1.1.21. It's fixed in 1.1.23 final release. Patch is at :
http://cvs.easysw.com/cvsweb.cgi/cups/scheduler/client.c.diff?r2=1.196&r1=1.195&f=u

[Comment 1 Thierry Carrez (RETIRED) 2005-01-07 07:10:32 UTC]

Confirmed through http://www.cups.org/str.php?L1042+P0+S-1+C0+I0+E0+Q1042
printing: please bump to 1.1.23 final...

[Comment 2 Heinrich Wendel (RETIRED) 2005-01-07 13:43:20 UTC]

bumped to 1.1.23 and marked stable on x86, the xpdf patches are no longer needed, since it uses xpdf directly now, remaining keywords:

~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc

[Comment 3 Heinrich Wendel (RETIRED) 2005-01-07 13:47:44 UTC]

ok, i included the patches again since xpdf isn't tested on all arches, but it's still bumped to 1.1.23 with all security fixes

[Comment 4 Thierry Carrez (RETIRED) 2005-01-10 01:27:43 UTC]

Arches please test 1.1.23 final and mark stable.

Will be released as an UPDATE to GLSA 200412-25.

[Comment 5 Lars Weiler (RETIRED) 2005-01-10 03:39:23 UTC]

ppc stable.

[Comment 6 Jeremy Huddleston (RETIRED) 2005-01-10 04:28:15 UTC]

amd64 and sparc are stable

[Comment 7 Markus Rothe (RETIRED) 2005-01-10 11:33:36 UTC]

Stable on ppc64

[Comment 8 Guy Martin (RETIRED) 2005-01-11 07:17:13 UTC]

Stable on hppa.

[Comment 9 Bryan Østergaard (RETIRED) 2005-01-11 11:39:10 UTC]

Alpha stable.

[Comment 10 Thierry Carrez (RETIRED) 2005-01-11 13:45:43 UTC]

Ready for GLSA update, will do it tomorrow.

[Comment 11 Thierry Carrez (RETIRED) 2005-01-12 01:25:16 UTC]

GLSA 200412-25:02 update
arm, ia64,mips,s390: please mark 1.1.23 stable to benefit from updated GLSA

[Comment 12 Hardave Riar (RETIRED) 2005-02-19 14:53:53 UTC]

Stable on mips