PT-2009-6736 · Apple+1 · Cups-Libs-X86+8

Aaron Sigel · Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-0163

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cups versions prior to 1.3.10 cups-libs-x86 (affected versions not specified) cups-debugsource (affected versions not specified) cups-libs-32bit (affected versions not specified) cups-client (affected versions not specified) cups-debuginfo (affected versions not specified) cups-devel (affected versions not specified) cups-libs (affected versions not specified)

Description The issue involves multiple vulnerabilities in the cups package of various Linux operating systems, including SUSE Linux Enterprise and Gentoo Linux. These vulnerabilities can be exploited remotely, potentially leading to a violation of confidentiality, integrity, and availability of protected information. The exploitation can result in a denial of service or possibly the execution of arbitrary code. Specifically, an integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a daemon crash and possibly execute arbitrary code via a crafted TIFF image. This is due to improper handling by the cupsImageReadTIFF function in the imagetops filter and the imagetoraster filter, leading to a heap-based buffer overflow.

Recommendations For cups versions prior to 1.3.10, update to version 1.3.10 or later. For cups-libs-x86, consider disabling the package until a patch is available. For cups-debugsource, restrict access to the package to minimize the risk of exploitation. For cups-libs-32bit, avoid using the package in sensitive operations until the issue is resolved. For cups-client, consider disabling the client functionality until a patch is available. For cups-debuginfo, restrict access to the package to minimize the risk of exploitation. For cups-devel, consider disabling the development package until a patch is available. For cups-libs, avoid using the package in sensitive operations until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

CWE-189

Related Identifiers

BDU:2015-04161

BDU:2015-04162

BDU:2015-04163

BDU:2015-04164

BDU:2015-04165

BDU:2015-04166

BDU:2015-04167

BDU:2015-04168

BDU:2015-09375

CVE-2009-0163

DSA-1773-1

OPENSUSE-SU-2024:10075-1

RHSA-2009:0428

RHSA-2009:0429

RHSA-2009_0429

Affected Products

Red Hat

Cups

Cups-Client

Cups-Debuginfo

Cups-Debugsource

Cups-Devel

Cups-Libs

Cups-Libs-32Bit

Cups-Libs-X86

References · 69

• https://bdu.fstec.ru/vul/2015-04167 · Security Note
• http://security.gentoo.org/glsa/glsa-200904-20.xml · Vendor Advisory
• http://secunia.com/advisories/34756 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0163 · Vendor Advisory
• http://secunia.com/advisories/34747 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html · Vendor Advisory
• http://secunia.com/advisories/34481 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04165 · Security Note
• https://bdu.fstec.ru/vul/2015-06216 · Security Note
• https://bdu.fstec.ru/vul/2015-04161 · Security Note
• http://secunia.com/advisories/34722 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04164 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10075-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0163 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08481 · Security Note