CVE-2017-18248

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.

CUPS before version 2.2.6 has a vulnerability in the handling of usernames in the scheduler/ipp.c:add_job() function. A remote attacker could exploit this by submitting a print job with an invalid UTF-8 username to cause a crash and subsequent denial of service (CVE-2017-18248).

These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

The following security vulnerabilities were fixed:

• CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. (bsc#1061066 bsc#1087018)
• Fixed a local privilege escalation to root and sandbox bypasses in the scheduler
• CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend (bsc#1096405)
• CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406)
• CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling (bsc#1096407)
• CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration (bsc#1096408)

The following other issue was fixed:

• Fixed authorization check for clients (like samba) connected through the local socket when Kerberos authentication is enabled (bsc#1050082)

It was discovered that CUPS incorrectly handled certain print jobs with invalid usernames. A remote attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2017-18248)

Dan Bastone discovered that the CUPS dnssd backend incorrectly handled certain environment variables. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-4180)

Eric Rafaloff and John Dunlap discovered that CUPS incorrectly handled certain include directives. A local attacker could possibly use this issue to read arbitrary files. (CVE-2018-4181)

Dan Bastone discovered that the CUPS AppArmor profile incorrectly confined the dnssd backend. A local attacker could possibly use this issue to escape confinement. (CVE-2018-6553)