Ubuntu 11.04 USN-1194-1 Medium: Foomatic Filters Remote Code Execution

ubuntu

August 22, 2011

An attacker could send crafted input to Foomatic and cause it to run programs as the "lp" user.

Summary

An attacker could send crafted input to Foomatic and cause it to run

programs as the "lp" user.

Software Description:

- foomatic-filters: OpenPrinting printer support - filters

Details:

It was discovered that the foomatic-rip Foomatic filter incorrectly

handled command-line options. An attacker could use this flaw to cause

Foomatic to execute arbitrary code as the "lp" user.

In the default installation, attackers would be isolated by the CUPS

AppArmor profile.

Topics Covered

security advisory security issue remote code execution medium severity Ubuntu foomatic filters

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  foomatic-filters                4.0.7-0ubuntu1.1

Ubuntu 10.10:
  foomatic-filters                4.0.5-0ubuntu3.1

Ubuntu 10.04 LTS:
  foomatic-filters                4.0.4-0ubuntu1.1

Ubuntu 8.04 LTS:
  foomatic-filters                3.0.2-20071204-0ubuntu2.3

In general, a standard system update will make all the necessary changes.