Integer overflow in _cupsImageReadTIFF() #3031

michaelrsweet opened this Issue Dec 3, 2008 · 3 comments

1 participant


Version: 1.3-current User: mike

As reported by iDefense:

Remote exploitation of an integer overflow vulnerability in CUPS, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code with the privileges of the affected service.

The Common Unix Printing System, more commonly referred to as CUPS, provides a standard printer interface for various Unix-based operating systems. "imagetops" is a part of CUPS responsible for creating PostScript representations of different graphic file formats.

When parsing TIFF files, the _cupsImageReadTIFF() function does not properly validate the image 'height' taken from the file. This value is then used in an arithmetic operation that calculates the size of a dynamic heap buffer. By providing a large value for the image height, this calculation can overflow, which then leads to a heap based buffer overflow.

Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service. Depending on the underlying operating system and distribution, CUPS may run as the lp, daemon or a different user.

Exploiting heap overflow vulnerabilities on modern Unix systems can be difficult due to various heap protection schemes. The attacker, however, has very fine-grained control over the overflow, which somewhat eases the difficulty of exploitation.

To exploit this vulnerability remotely, the targeted host must be sharing one or more printers on the network. If a printer is not being shared, CUPS only listens on the localhost interface, and the scope of this vulnerability would be limited to local privilege escalation.

It is always our goal to coordinate on the public disclosure of patches/advisories as quickly as possible after a vulnerability is discovered.If, however, a reasonable time-frame cannot be agreed upon for this issue,it will be publicly released in 60 days on 02/01/2009.

@michaelrsweet User: mike

Simplest "fix" seems to be reducing the CUPS_IMAGE_MAX_HEIGHT constant to 2^30-1.

Patch attached.

@michaelrsweet User: mike

Fixed in Subversion repository.



Index: filter/image-private.h

--- filter/image-private.h (revision 8153)
+++ filter/image-private.h (working copy)
@@ -40,8 +40,8 @@

# define CUPS_IMAGE_MAX_WIDTH 0x07ffffff
/* 2^27-1 to allow for 15-channel data */
-# define CUPS_IMAGE_MAX_HEIGHT 0x7fffffff

  • /* 2^31-1 */ +# define CUPS_IMAGE_MAX_HEIGHT 0x3fffffff
  •               /* 2^30-1 */

    define CUPS_TILE_SIZE 256 /* 256x256 pixel tiles */

    define CUPS_TILE_MINIMUM 10 /* Minimum number of tiles */

@michaelrsweet michaelrsweet added this to the Stable milestone Mar 17, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment