oss-security - CVE Request - cups: 'Listen localhost:631' option not honoured correctly on IPv6-enabled systems when systemd used for CUPS socket activation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1904201237.53293871.1357313344781.JavaMail.root@redhat.com>
Date: Fri, 4 Jan 2013 10:29:04 -0500 (EST)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Tim Waugh <twaugh@...hat.com>, Jiri Popelka <jpopelka@...hat.com>
Subject: CVE Request - cups:  'Listen localhost:631' option not honoured
 correctly on IPv6-enabled systems when systemd used for CUPS socket
 activation

Hello Kurt, Steve, vendors,

  during the process of CUPS socket activation code refactoring in favour
of systemd capability a security flaw was found in the way CUPS service
honoured Listen localhost:631 cupsd.conf configuration option. The setting
was recognized properly for IPv4-enabled systems, but failed to be correctly
applied for IPv6-enabled systems. As a result, a remote attacker could use
this flaw to obtain (unauthorized) access to the CUPS web-based administration
interface.

References:
[1] https://bugzilla.novell.com/show_bug.cgi?id=795624
[2] https://bugzilla.redhat.com/show_bug.cgi?id=891942

Note: Obviously this would affect only instances, where CUPS was instructed
to pass its socket activation code to systemd (instances not using systemd
would not be affected by this problem).

Could you allocate a CVE identifier for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.