Vulnerability Bulletins |
Denegación de servicio en CUPS |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Denegación de Servicio |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | CUPS 1.3.3 |
Description |
|
|
Se ha encontrado una vulnerabilidad del tipo desbordamiento de búfer en CUPS 1.3.3. La vulnerabilidad reside en un error en los archivos cups/ipp.c en la función ippReadIO. Un atacante remoto podría causar una denegación de servicio mediante una etiqueta textWithLanguage o nameWithLanguage Internet Printing Protocol especialmente diseñada. |
|
Solution |
|
|
Actualización de software Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. Red Hat (RHSA-2007:1020-3) RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux Desktop (v. 5 client) https://rhn.redhat.com/ Mandriva (MDKSA-2007:204) Corporate Server 3.0 X86 corporate/3.0/i586/cups-1.1.20-5.13.C30mdk.i586.rpm corporate/3.0/i586/cups-common-1.1.20-5.13.C30mdk.i586.rpm corporate/3.0/i586/cups-serial-1.1.20-5.13.C30mdk.i586.rpm corporate/3.0/i586/libcups2-1.1.20-5.13.C30mdk.i586.rpm corporate/3.0/i586/libcups2-devel-1.1.20-5.13.C30mdk.i586.rpm corporate/3.0/SRPMS/cups-1.1.20-5.13.C30mdk.src.rpm X86_64 corporate/3.0/x86_64/cups-1.1.20-5.13.C30mdk.x86_64.rpm corporate/3.0/x86_64/cups-common-1.1.20-5.13.C30mdk.x86_64.rpm corporate/3.0/x86_64/cups-serial-1.1.20-5.13.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64cups2-1.1.20-5.13.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64cups2-devel-1.1.20-5.13.C30mdk.x86_64.rpm corporate/3.0/SRPMS/cups-1.1.20-5.13.C30mdk.src.rpm Mandriva Linux 2007 X86 2007.0/i586/cups-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/i586/cups-common-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/i586/cups-serial-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/i586/libcups2-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/i586/libcups2-devel-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/i586/php-cups-1.2.4-1.4mdv2007.0.i586.rpm 2007.0/SRPMS/cups-1.2.4-1.4mdv2007.0.src.rpm X86_64 2007.0/x86_64/cups-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/x86_64/cups-common-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/x86_64/cups-serial-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/x86_64/lib64cups2-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/x86_64/lib64cups2-devel-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/x86_64/php-cups-1.2.4-1.4mdv2007.0.x86_64.rpm 2007.0/SRPMS/cups-1.2.4-1.4mdv2007.0.src.rpm Corporate Server 4.0 X86 corporate/4.0/i586/cups-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/i586/cups-common-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/i586/cups-serial-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/i586/libcups2-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/i586/libcups2-devel-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/i586/php-cups-1.2.4-0.4.20060mlcs4.i586.rpm corporate/4.0/SRPMS/cups-1.2.4-0.4.20060mlcs4.src.rpm X86_64 corporate/4.0/x86_64/cups-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/cups-common-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/cups-serial-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/lib64cups2-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/lib64cups2-devel-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/php-cups-1.2.4-0.4.20060mlcs4.x86_64.rpm corporate/4.0/SRPMS/cups-1.2.4-0.4.20060mlcs4.src.rpm Mandriva Linux 2007.1 X86 2007.1/i586/cups-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/i586/cups-common-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/i586/cups-serial-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/i586/libcups2-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/i586/libcups2-devel-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/i586/php-cups-1.2.10-2.2mdv2007.1.i586.rpm 2007.1/SRPMS/cups-1.2.10-2.2mdv2007.1.src.rpm X86_64 2007.1/x86_64/cups-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/x86_64/cups-common-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/x86_64/cups-serial-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/x86_64/lib64cups2-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/x86_64/lib64cups2-devel-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/x86_64/php-cups-1.2.10-2.2mdv2007.1.x86_64.rpm 2007.1/SRPMS/cups-1.2.10-2.2mdv2007.1.src.rpm Red Hat (RHSA-2007:1022-2) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ Red Hat (RHSA-2007:1023-2) Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) https://rhn.redhat.com/ Mandriva (MDKSA-2007:204-1) Mandriva Linux 2008.0 X86 2008.0/i586/cups-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/i586/cups-common-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/i586/cups-serial-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/i586/libcups2-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/i586/libcups2-devel-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/i586/php-cups-1.3.0-3.2mdv2008.0.i586.rpm 2008.0/SRPMS/cups-1.3.0-3.2mdv2008.0.src.rpm X86_64 2008.0/x86_64/cups-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/x86_64/cups-common-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/x86_64/cups-serial-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/x86_64/lib64cups2-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/x86_64/lib64cups2-devel-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/x86_64/php-cups-1.3.0-3.2mdv2008.0.x86_64.rpm 2008.0/SRPMS/cups-1.3.0-3.2mdv2008.0.src.rpm Debian (DSA 1407-1) Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7.orig.tar.gz http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1.diff.gz http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1.dsc Architecture independent http://security.debian.org/pool/updates/main/c/cupsys/cupsys-common_1.2.7-4etch1_all.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-gnutls10_1.2.7-4etch1_all.deb alpha http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_alpha.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_alpha.deb amd64 http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_amd64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_amd64.deb hppa http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_hppa.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_hppa.deb i386 http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_i386.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_i386.deb ia64 http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_ia64.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_ia64.deb mips http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_mips.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_mips.deb mipsel http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_mipsel.deb powerpc http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_powerpc.deb s390 http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_s390.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_s390.deb sparc http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch1_sparc.deb http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch1_sparc.deb Apple Security Update 2007-009 / Mac OS X 10.4.11 (Universal) http://www.apple.com/support/downloads/securityupdate200700910411universal.html Security Update 2007-009 / Max OS X 10.4.11 (PPC) http://www.apple.com/support/downloads/securityupdate200700910411ppc.html Security Update 2007-009 / Max OS X 10.5.1 http://www.apple.com/support/downloads/securityupdate20070091051.html Cisco Cisco Wide Area Application Service 4.0.19.14 http://www.cisco.com/pcgi-bin/tablebuild.pl/waas40?psrtdcat20e2 |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2007-4351 |
| BID | 26268 |
Other resources |
|
|
SUSE Security Advisory (SUSE-SA:2007:058) http://www.novell.com/linux/security/advisories/2007_58_cups.html Red Hat Security Advisory (RHSA-2007:1020-3) https://rhn.redhat.com/errata/RHSA-2007-1020.html Mandriva Security Advisory (MDKSA-2007:204) http://www.mandriva.com/security/advisories?name=MDKSA-2007:204 Red Hat Security Advisory (RHSA-2007:1022-2) https://rhn.redhat.com/errata/RHSA-2007-1022.html Red Hat Security Advisory (RHSA-2007:1023-2) https://rhn.redhat.com/errata/RHSA-2007-1023.html Mandriva Security Advisory (MDKSA-2007:204-1) http://www.mandriva.com/security/advisories?name=MDKSA-2007:204-1 Debian Security Advisory (DSA 1407-1) http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00186.html Apple Security Update (307179) http://docs.info.apple.com/article.html?artnum=307179 Cisco Security Advisory (cisco-sr-20080625-waas) http://www.cisco.com/warp/public/707/cisco-sr-20080625-waas.shtml |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2007-11-06 |
| 1.1 | Aviso emitido por Mandriva (MDKSA-2007:204) | 2007-11-07 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2007:1022-2), aviso emitido por Red Hat (RHSA-2007:1023-2) | 2007-11-09 |
| 1.3 | Aviso actualizado por Mandriva (MDKSA-2007:204-1) | 2007-11-15 |
| 1.4 | Aviso emitido por Debian (DSA 1407-1) | 2007-11-21 |
| 1.5 | Aviso emitido por Apple (307179) | 2007-12-19 |
| 1.6 | Aviso emitido por Cisco (cisco-sr-20080625-waas) | 2008-06-27 |