CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability

Bugtraq ID:	41126
Class:	Design Error
CVE:	CVE-2010-2432
Remote:	Yes
Local:	No
Published:	Jun 17 2010 12:00AM
Updated:	Jul 10 2012 06:20AM
Credit:	bernerus
Vulnerable:	Sun Solaris 11 Express Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Easy Software Products CUPS 1.4.2 Easy Software Products CUPS 1.4.1 Easy Software Products CUPS 1.3.10 Easy Software Products CUPS 1.3.9 Easy Software Products CUPS 1.3.8 Easy Software Products CUPS 1.3.7 Easy Software Products CUPS 1.3.6 Easy Software Products CUPS 1.3.5 Easy Software Products CUPS 1.3.3 Easy Software Products CUPS 1.3.2 Easy Software Products CUPS 1.2.12 Easy Software Products CUPS 1.2.10 Easy Software Products CUPS 1.2.9 Easy Software Products CUPS 1.2.8 Easy Software Products CUPS 1.2.4 Easy Software Products CUPS 1.2.2 Easy Software Products CUPS 1.1.23 rc1 + Gentoo Linux Easy Software Products CUPS 1.1.23 + Gentoo Linux Easy Software Products CUPS 1.1.22 rc1 Easy Software Products CUPS 1.1.22 Easy Software Products CUPS 1.1.21 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 Easy Software Products CUPS 1.1.20 + ALT Linux ALT Linux Compact 2.3 + ALT Linux ALT Linux Junior 2.3 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + MandrakeSoft apcupsd 2006.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux Personal 9.1 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Easy Software Products CUPS 1.1.19 rc5 Easy Software Products CUPS 1.1.19 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Turbolinux Appliance Server 1.0 Workgroup Edition + Turbolinux Appliance Server 1.0 Hosting Edition + Turbolinux Appliance Server Hosting Edition 1.0 + Turbolinux Appliance Server Workgroup Edition 1.0 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Workstation 8.0 Easy Software Products CUPS 1.1.18 + Conectiva Linux 9.0 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + S.u.S.E. Linux Personal 8.2 Easy Software Products CUPS 1.1.17 + Red Hat Enterprise Linux AS 3 + RedHat Desktop 3.0 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux WS 3 Easy Software Products CUPS 1.1.16 + Mandriva Linux Mandrake 9.0 Easy Software Products CUPS 1.1.15 + Conectiva Linux Enterprise Edition 1.0 + S.u.S.E. Linux 8.1 Easy Software Products CUPS 1.1.14 + Conectiva Linux 8.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 Easy Software Products CUPS 1.1.13 Easy Software Products CUPS 1.1.12 + S.u.S.E. Linux 8.0 i386 + S.u.S.E. Linux 8.0 Easy Software Products CUPS 1.1.10 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 + Conectiva Linux 7.0 + Conectiva Linux 6.0 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + S.u.S.E. Linux 7.3 sparc + S.u.S.E. Linux 7.3 ppc + S.u.S.E. Linux 7.3 i386 Easy Software Products CUPS 1.1.7 Easy Software Products CUPS 1.1.6 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + S.u.S.E. Linux 7.2 i386 + S.u.S.E. Linux 7.1 x86 + S.u.S.E. Linux 7.1 sparc + S.u.S.E. Linux 7.1 ppc + S.u.S.E. Linux 7.1 alpha Easy Software Products CUPS 1.1.4 -5 Easy Software Products CUPS 1.1.4 -3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.4 -2 + Debian Linux 2.3 Easy Software Products CUPS 1.1.4 + Debian Linux 2.3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.1 + RedHat PowerTools 7.0 Easy Software Products CUPS 1.0.4 -8 + Debian Linux 2.2 Easy Software Products CUPS 1.0.4 + Debian Linux 2.2 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Easy Software Products CUPS 1.4.4

CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability

CUPS (Common UNIX Printing System) is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to fall into an infinite loop, denying service to legitimate users.

Versions prior to CUPS 1.4.4 are vulnerable.

CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva cups-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-devel-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.3.10-0.5mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva cups-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-devel-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.3.10-0.5mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva cups-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-devel-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.4.3-3.2mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2010.1

• Mandriva cups-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-devel-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.4.3-3.2mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2009.0

• Mandriva cups-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcups2-devel-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.3.10-0.5mdv2009.0.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva cups-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-common-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva cups-serial-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64cups2-devel-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-cups-1.3.10-0.5mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/

CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability

References:

• CUPS 1.4.4 (Easy Software Products)
  
• CUPS Product Page (Easy Software Products)
  
• TR #3518: Infinite loop when not compiled with HAVE_GSSAPI (Bererus)
  
• Multiple Vulnerabilities in CUPS Printing System (Oracle)