CUPS.org User: mike
As reported by iDefense:
Remote exploitation of an integer overflow vulnerability in CUPS, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code with the privileges of the affected service.
The Common Unix Printing System, more commonly referred to as CUPS, provides a standard printer interface for various Unix-based operating systems. "imagetops" is a part of CUPS responsible for creating PostScript representations of different graphic file formats.
When parsing TIFF files, the _cupsImageReadTIFF() function does not properly validate the image 'height' taken from the file. This value is then used in an arithmetic operation that calculates the size of a dynamic heap buffer. By providing a large value for the image height, this calculation can overflow, which then leads to a heap based buffer overflow.
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service. Depending on the underlying operating system and distribution, CUPS may run as the lp, daemon or a different user.
Exploiting heap overflow vulnerabilities on modern Unix systems can be difficult due to various heap protection schemes. The attacker, however, has very fine-grained control over the overflow, which somewhat eases the difficulty of exploitation.
To exploit this vulnerability remotely, the targeted host must be sharing one or more printers on the network. If a printer is not being shared, CUPS only listens on the localhost interface, and the scope of this vulnerability would be limited to local privilege escalation.
It is always our goal to coordinate on the public disclosure of patches/advisories as quickly as possible after a vulnerability is discovered.If, however, a reasonable time-frame cannot be agreed upon for this issue,it will be publicly released in 60 days on 02/01/2009.
CUPS.org User: mike
Simplest "fix" seems to be reducing the CUPS_IMAGE_MAX_HEIGHT constant to 2^30-1.
Fixed in Subversion repository.
--- filter/image-private.h (revision 8153)
+++ filter/image-private.h (working copy)
@@ -40,8 +40,8 @@
/\* 2^27-1 to allow for 15-channel data */
-# define CUPS_IMAGE_MAX_HEIGHT 0x7fffffff
/\* 2^31-1 */
+# define CUPS_IMAGE_MAX_HEIGHT 0x3fffffff
/* 2^30-1 */