Red Hat Linux Advisory: cups

Red Hat Security Advisory

Synopsis:	Updated CUPS packages fix denial of service attack
Advisory ID:	RHSA-2003:171-01
Issue date:	2003-05-27
Updated on:	2003-05-27
Product:	Red Hat Linux
Keywords:
Cross references:
Obsoletes:	RHSA-2002:295
CVE Names:	CAN-2003-0195

Topic:

Updated CUPS packages that fix a denial of service vulnerability
are now available.

2. Relevant releases/architectures:

Red Hat Linux 7.3 – i386
Red Hat Linux 8.0 – i386
Red Hat Linux 9 – i386

3. Problem description:

CUPS is a print spooler. CUPS is used as the default print
spooler on new installations of Red Hat Linux 9, and has been
provided (though not as the default) for Red Hat Linux 7.3 and Red
Hat Linux 8.0.

Phil D’Amore of Red Hat discovered a vulnerability in the CUPS
IPP (Internet Printing Protocol) implementation. The IPP
implementation is single-threaded, which means only one request can
be serviced at a time. An attacker could make a partial request
that does not time out and therefore creates a denial of service.
In order to exploit this bug, an attacker must have the ability to
make a TCP connection to the IPP port (by default 631).

All print servers using CUPS should upgrade to these erratum
packages, which contain a patch and are not vulnerable to this
issue.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.

Please note that this update is also available via Red Hat
Network. Many people find this an easier way to apply updates. To
use Red Hat Network, launch the Red Hat Update Agent with the
following command:

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. RPMs required:

Red Hat Linux 7.3:

SRPMS:

ftp://updates.redhat.com/7.3/en/os/SRPMS/cups-1.1.14-15.4.src.rpm

i386:

ftp://updates.redhat.com/7.3/en/os/i386/cups-1.1.14-15.4.i386.rpm

ftp://updates.redhat.com/7.3/en/os/i386/cups-libs-1.1.14-15.4.i386.rpm

ftp://updates.redhat.com/7.3/en/os/i386/cups-devel-1.1.14-15.4.i386.rpm

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/cups-1.1.17-0.7.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/cups-1.1.17-0.7.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/cups-libs-1.1.17-0.7.i386.rpm