Ubuntu 24.04: USN-6844-1 Severe: CUPS Permission Modification Problem

ubuntu

June 25, 2024

CUPS could be made to arbitrary chmod paths with specially crafted configuration file.

Summary

CUPS could be made to arbitrary chmod paths with specially

crafted configuration file.

Software Description:

- cups: Common UNIX Printing System(tm)

Details:

Rory McNamara discovered that when starting the cupsd server with a

Listen configuration item, the cupsd process fails to validate if

bind call passed. An attacker could possibly trick cupsd to perform

an arbitrary chmod of the provided argument, providing world-writable

access to the target.

Topics Covered

security advisory security update software patch Ubuntu CUPS configuration file chmod issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  cups                            2.4.7-1.2ubuntu7.1

Ubuntu 23.10
  cups                            2.4.6-0ubuntu3.1

Ubuntu 22.04 LTS
  cups                            2.4.1op1-1ubuntu4.9

Ubuntu 20.04 LTS
  cups                            2.3.1-9ubuntu1.7

Ubuntu 18.04 LTS
  cups                            2.2.7-1ubuntu2.10+esm4
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  cups                            2.1.3-4ubuntu0.11+esm6
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.