CUPS Scheduler Directory Services Remote Denial Of Service Vulnerability

Bugtraq ID:	35194
Class:	Design Error
CVE:	CVE-2009-1196
Remote:	Yes
Local:	No
Published:	Jun 03 2009 12:00AM
Updated:	Oct 20 2009 04:08PM
Credit:	Swen van Brussel
Vulnerable:	Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Desktop 3.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Easy Software Products CUPS 1.1.22 rc1 Easy Software Products CUPS 1.1.22 Easy Software Products CUPS 1.1.21 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 Easy Software Products CUPS 1.1.20 + ALT Linux ALT Linux Compact 2.3 + ALT Linux ALT Linux Junior 2.3 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + MandrakeSoft apcupsd 2006.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux Personal 9.1 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Easy Software Products CUPS 1.1.19 rc5 Easy Software Products CUPS 1.1.19 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Turbolinux Appliance Server 1.0 Workgroup Edition + Turbolinux Appliance Server 1.0 Hosting Edition + Turbolinux Appliance Server Hosting Edition 1.0 + Turbolinux Appliance Server Workgroup Edition 1.0 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Workstation 8.0 Easy Software Products CUPS 1.1.18 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + S.u.S.E. Linux Personal 8.2 Easy Software Products CUPS 1.1.17 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 Easy Software Products CUPS 1.1.16 + Mandriva Linux Mandrake 9.0 Easy Software Products CUPS 1.1.15 + Conectiva Linux Enterprise Edition 1.0 + SuSE Linux 8.1 Easy Software Products CUPS 1.1.14 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 Easy Software Products CUPS 1.1.13 Easy Software Products CUPS 1.1.12 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 Easy Software Products CUPS 1.1.10 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 Easy Software Products CUPS 1.1.7 Easy Software Products CUPS 1.1.6 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + SuSE Linux 7.2 i386 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha Easy Software Products CUPS 1.1.4 -5 Easy Software Products CUPS 1.1.4 -3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.4 -2 + Debian Linux 2.3 Easy Software Products CUPS 1.1.4 + Debian Linux 2.3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.1 + Redhat PowerTools 7.0 DrPhibez and Nitro187 Guild FTPD 1.1.19 rc5 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0 Avaya Message Networking MN 3.1 Avaya Message Networking 3.1 Avaya Message Networking
Not Vulnerable:

CUPS Scheduler Directory Services Remote Denial Of Service Vulnerability

CUPS is prone to a denial-of-service vulnerability.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.

CUPS Scheduler Directory Services Remote Denial Of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CUPS Scheduler Directory Services Remote Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for details.


MandrakeSoft Multi Network Firewall 2.0

• Mandriva cups-1.1.20-5.21.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-common-1.1.20-5.21.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-serial-1.1.20-5.21.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcups2-1.1.20-5.21.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcups2-devel-1.1.20-5.21.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva cups-1.1.20-5.21.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-common-1.1.20-5.21.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-serial-1.1.20-5.21.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64cups2-1.1.20-5.21.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64cups2-devel-1.1.20-5.21.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva cups-1.1.20-5.21.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-common-1.1.20-5.21.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva cups-serial-1.1.20-5.21.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcups2-1.1.20-5.21.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcups2-devel-1.1.20-5.21.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

CUPS Scheduler Directory Services Remote Denial Of Service Vulnerability

References:

• Avaya Security Advisory ASA-2009-227 (Avaya)
  
• Bug 497135 �?? CVE-2009-1196 cups: DoS (stop, crash) by renewing CUPS browse packe (Jan Lieskovsky)
  
• CUPS Product Page (Easy Software Products)