Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 77023 - net-print/cups: DoS by HTTP request
Summary: net-print/cups: DoS by HTTP request
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa] koon
Depends on:
Reported: 2005-01-07 07:07 UTC by Thierry Carrez (RETIRED)
Modified: 2005-08-15 21:27 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Thierry Carrez (RETIRED) gentoo-dev 2005-01-07 07:07:28 UTC
I was tipped by amne on IRC and michip on the forums about a Nessus-triggered cupsd DoS.

I narrowed it to the following HTTP request on port 631 : "GET /..X"
You can reproduce it using :
$ echo -e "GET /..A\n" | nc localhost 631

cupsd will hang and use 100% CPU.

It didn't occur with the CUPS 1.1.20 I was using before.

in scheduler/client.c:

  while ((path = strstr(path, "/..")) != NULL)
    if (!path[3] || path[3] == '/')
      return (0);

This was introduced between 1.1.20 and 1.1.21. It's fixed in 1.1.23 final release. Patch is at :
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-01-07 07:10:32 UTC
Confirmed through
printing: please bump to 1.1.23 final...
Comment 2 Heinrich Wendel (RETIRED) gentoo-dev 2005-01-07 13:43:20 UTC
bumped to 1.1.23 and marked stable on x86, the xpdf patches are no longer needed, since it uses xpdf directly now, remaining keywords:

~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc
Comment 3 Heinrich Wendel (RETIRED) gentoo-dev 2005-01-07 13:47:44 UTC
ok, i included the patches again since xpdf isn't tested on all arches, but it's still bumped to 1.1.23 with all security fixes
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2005-01-10 01:27:43 UTC
Arches please test 1.1.23 final and mark stable.

Will be released as an UPDATE to GLSA 200412-25.
Comment 5 Lars Weiler (RETIRED) gentoo-dev 2005-01-10 03:39:23 UTC
ppc stable.
Comment 6 Jeremy Huddleston (RETIRED) gentoo-dev 2005-01-10 04:28:15 UTC
amd64 and sparc are stable
Comment 7 Markus Rothe (RETIRED) gentoo-dev 2005-01-10 11:33:36 UTC
Stable on ppc64
Comment 8 Guy Martin (RETIRED) gentoo-dev 2005-01-11 07:17:13 UTC
Stable on hppa.
Comment 9 Bryan Østergaard (RETIRED) gentoo-dev 2005-01-11 11:39:10 UTC
Alpha stable.
Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2005-01-11 13:45:43 UTC
Ready for GLSA update, will do it tomorrow.
Comment 11 Thierry Carrez (RETIRED) gentoo-dev 2005-01-12 01:25:16 UTC
GLSA 200412-25:02 update
arm, ia64,mips,s390: please mark 1.1.23 stable to benefit from updated GLSA
Comment 12 Hardave Riar (RETIRED) gentoo-dev 2005-02-19 14:53:53 UTC
Stable on mips