Bug 438450 – <net-print/cups-pk-helper-0.2.4 : wraps cupsGetFile/cupsPutFile in an insecure way (CVE-2012-4510)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-10-15 08:47:59 UTC]

From oss-security:

cups-pk-helper (versions up to 0.2.2) wraps cupsGetFile/cupsPutFile in
an insecure way. Since cups-pk-helper is running as root, this could
lead to uploading sensitive data to a cups resource, or overwriting
specific files with the content of a cups resource. The flaw is however
mitigated by the fact that it cannot be exploited without the user
explicitly approving the action (via polkit authentication with the
admin password).

This has been fixed in cups-pk-helper 0.2.3:
  http://www.freedesktop.org/software/cups-pk-helper/releases/cups-pk-helper-0.2.3.tar.xz

Thanks to Sebastian Krahmer and Alexander Peslyak for their help in
reviewing the fix.

Reference: CVE-2012-4510

About cups-pk-helper:
  cups-pk-helper is a PolicyKit helper to configure cups with
  fine-grained privileges.

  See http://www.freedesktop.org/wiki/Software/cups-pk-helper

[Comment 1 Alexandre Rostovtsev (RETIRED) 2012-10-16 02:32:13 UTC]

Thanks, fixed in cups-pk-helper-0.2.4. According to the list in bug #427544, it needs to be stabilized for alpha, amd64, arm, and x86.

>*cups-pk-helper-0.2.4 (16 Oct 2012)
>
>  16 Oct 2012; Alexandre Rostovtsev <[e-mail]>
>  -cups-pk-helper-0.2.1.ebuild, cups-pk-helper-0.2.2.ebuild,
>  +cups-pk-helper-0.2.4.ebuild:
>  Version bump; fixes a security flaw that allowed users to overwrite system
>  files (bug #438450, CVE-2012-4510). Update license. Drop old.

[Comment 2 Agostino Sarubbo 2012-10-17 10:36:08 UTC]

Arches, please test and mark stable:
=net-print/cups-pk-helper-0.2.4
Target keywords : "alpha amd64 arm x86"

alpha is already stable

[Comment 3 Agostino Sarubbo 2012-10-17 11:07:40 UTC]

amd64 stable

[Comment 4 Markus Meier 2012-10-17 19:18:12 UTC]

arm stable

[Comment 5 Andreas Schürch 2012-10-25 14:27:27 UTC]

x86 done, last arch!

[Comment 6 Sean Amoss (RETIRED) 2012-10-25 15:42:29 UTC]

Thanks, everyone.

GLSA vote: no.

[Comment 7 GLSAMaker/CVETool Bot 2012-11-20 12:50:31 UTC]

CVE-2012-4510 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4510):
  cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and
  (2) cupsPutFile function calls, which allows user-assisted remote attackers
  to read or overwrite sensitive files using CUPS resources.

[Comment 8 Stefan Behte (RETIRED) 2012-12-16 22:09:15 UTC]

Vote: No. Closing noglsa.