Lucene search

RootSSV:5068

HistoryApr 18, 2009 - 12:00 a.m.

CUPS _cupsImageReadTIFF()函数整数溢出漏洞

2009-04-1800:00:00

Root

www.seebug.org

0.022 Low

EPSS

Percentile

88.2%

JSON

BUGTRAQ ID: 34571
CVE(CAN) ID: CVE-2009-0163

Common Unix Printing System（CUPS）是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。

CUPS的_cupsImageReadTIFF()函数在解析TIFF文件时没有正确地验证从文件读取的图形高度参数便将height值用于计算动态堆缓冲区的大小。如果在图像文件中设置了很大的高度值，计算就可能溢出，导致以CUPS服务的权限执行任意代码。

Easy Software Products CUPS < 1.3.10
Debian

Debian已经为此发布了一个安全公告（DSA-1773-1）以及相应补丁:
DSA-1773-1：New cups packages fix arbitrary code execution
链接：<a href=“http://www.debian.org/security/2009/dsa-1773” target=“_blank”>http://www.debian.org/security/2009/dsa-1773</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch7.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch7.dsc</a>
Size/MD5 checksum: 1092 4203af9c21af4d6918245cd45acb06bb
<a href=“http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch7.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch7.diff.gz</a>
Size/MD5 checksum: 109374 af603a7173c6df4f33b048ffc7115bd8
<a href=“http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7.orig.tar.gz</a>
Size/MD5 checksum: 4214272 c9ba33356e5bb93efbcf77b6e142e498

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-gnutls10_1.2.7-4etch7_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-gnutls10_1.2.7-4etch7_all.deb</a>
Size/MD5 checksum: 46244 44171d0a66210c387b6af8448f6d521d
<a href=“http://security.debian.org/pool/updates/main/c/cupsys/cupsys-common_1.2.7-4etch7_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/c/cupsys/cupsys-common_1.2.7-4etch7_all.deb</a>
Size/MD5 checksum: 893990 3f5525cb2fc50e8a06352e587737e2dc

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

i386 architecture (Intel ia32)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian GNU/Linux 5.0 alias lenny

Debian (stable)

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

<a href=“http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1lenny5.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1lenny5.dsc</a>
Size/MD5 checksum: 1833 4c8778e239a30fb22d2f183c32c698f9
<a href=“http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8.orig.tar.gz</a>
Size/MD5 checksum: 4796827 10efe9825c1a1dcd325be47a6cc21faf
<a href=“http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1lenny5.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1lenny5.diff.gz</a>
Size/MD5 checksum: 184239 dd404146b1e9f016cc820f7892ed17c7

Architecture independent packages:

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade

Easy Software Products

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://www.cups.org/strfiles/3031/str3031.patch” target=“_blank”>http://www.cups.org/strfiles/3031/str3031.patch</a>

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2009:0428-01）以及相应补丁:
RHSA-2009:0428-01：Moderate: cups security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2009-0428.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2009-0428.html</a>