#VU32839 Heap-based buffer overflow in CUPS - CVE-2011-2896

Vulnerability identifier: #VU32839

Vulnerability risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-2896

CWE-ID: CWE-122

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
CUPS
Server applications / Other server solutions

Vendor: Apple Inc.

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which. A remote attacker can use a crafted compressed stream to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Update to version 1.4.7.

Vulnerable software versions

CUPS: 1.4.0 - 1.4.6

---

External links
https://cups.org/str.php?L3867
https://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfc
https://lists.fedoraproject.org/pipermail/package-announce/2011-August/064600.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-August/064873.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-September/065527.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-September/065539.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-September/065550.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-September/065651.html
https://rhn.redhat.com/errata/RHSA-2012-1180.html
https://rhn.redhat.com/errata/RHSA-2012-1181.html
https://secunia.com/advisories/45621
https://secunia.com/advisories/45900
https://secunia.com/advisories/45945
https://secunia.com/advisories/45948
https://secunia.com/advisories/46024
https://secunia.com/advisories/48236
https://secunia.com/advisories/48308
https://secunia.com/advisories/50737
https://security.gentoo.org/glsa/glsa-201209-23.xml
https://www.debian.org/security/2011/dsa-2354
https://www.debian.org/security/2012/dsa-2426
https://www.mandriva.com/security/advisories?name=MDVSA-2011:146
https://www.mandriva.com/security/advisories?name=MDVSA-2011:167
https://www.openwall.com/lists/oss-security/2011/08/10/10
https://www.redhat.com/support/errata/RHSA-2011-1635.html
https://www.securityfocus.com/bid/49148
https://www.securitytracker.com/id?1025929
https://www.swi-prolog.org/bugzilla/show_bug.cgi?id=7#c4
https://www.ubuntu.com/usn/USN-1207-1
https://www.ubuntu.com/usn/USN-1214-1
https://bugzilla.redhat.com/show_bug.cgi?id=727800
https://bugzilla.redhat.com/show_bug.cgi?id=730338

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.