漏洞信息详情

CUPS CuPSD请求模式远程拒绝服务攻击漏洞

• CNNVD编号：CNNVD-200306-092
• 危害等级： 低危
  
• CVE编号： CVE-2003-0195
• 漏洞类型： 设计错误
• 发布时间： 2003-06-16
• 威胁类型： 远程
• 更新时间： 2005-10-20
• 厂        商： slackware
• 漏洞来源： Phil D'Amore

漏洞简介

CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple Common Unix Printing System（CUPS）是美国苹果（CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple）公司的一套开源的用于OS X和类Unix系统的打印系统。该系统基于Internet打印协议（IPP），提供大多数PostScript和raster打印机服务。 cuPSD没有充分对恶意HTTP请求进行超时控制，远程攻击者可以利用这个漏洞对cuPSD服务程序进行拒绝服务攻击。 CUPS的IPP(Internet Printing Protocol)实现存在漏洞，IPP实现是单线程的，意味着每个时间只能对一个请求进行服务，而且没有对请求进行超时限制，攻击者提交一个不会超时的请求就可以导致服务程序停止对其他请求的服务，导致拒绝服务攻击。攻击者要利用此漏洞必须能连接IPP端口(默认为631)。

漏洞公告

厂商补丁： MandrakeSoft ------------ MandrakeSoft已经为此发布了一个安全公告(MDKSA-2003:062)以及相应补丁:

MDKSA-2003:062：Updated cups packages fix Denial of Service vulnerability

链接： http://www.linux-mandrake.com/en/security/2003/2003-062.php

补丁下载：

Updated Packages:

Corporate Server 2.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/cups-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/cups-common-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/cups-serial-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/libcups1-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/libcups1-devel-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/SRPMS/cups-1.1.18-2.1mdk.src.rpm

Mandrake Linux 8.2:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/cups-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/cups-common-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/cups-serial-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/libcups1-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/libcups1-devel-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/SRPMS/cups-1.1.18-2.1mdk.src.rpm

Mandrake Linux 8.2/PPC:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/RPMS/cups-1.1.18-2.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/RPMS/cups-common-1.1.18-2.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/RPMS/cups-serial-1.1.18-2.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/RPMS/libcups1-1.1.18-2.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/RPMS/libcups1-devel-1.1.18-2.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.2/SRPMS/cups-1.1.18-2.1mdk.src.rpm

Mandrake Linux 9.0:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/cups-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/cups-common-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/cups-serial-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libcups1-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libcups1-devel-1.1.18-2.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/SRPMS/cups-1.1.18-2.1mdk.src.rpm

Mandrake Linux 9.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/cups-1.1.19-1.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/cups-common-1.1.19-1.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/cups-serial-1.1.19-1.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/libcups1-1.1.19-1.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/libcups1-devel-1.1.19-1.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/SRPMS/cups-1.1.19-1.1mdk.src.rpm

Mandrake Linux 9.1/PPC:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/cups-1.1.19-1.1mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/cups-common-1.1.19-1.1mdk.ppc.rpm

参考网址

来源: REDHAT 名称: RHSA-2003:171 链接:http://www.redhat.com/support/errata/RHSA-2003-171.HTML 来源: DEBIAN 名称: DSA-317 链接:http://www.debian.org/security/2003/dsa-317 来源: TURBO 名称: TLSA-2003-33 链接:http://www.turbolinux.com/security/TLSA-2003-33.txt 来源: SUSE 名称: SuSE-SA:2003:028 链接:http://www.novell.com/linux/security/advisories/2003_028.HTML 来源: BID 名称: 7637 链接:http://www.securityfocus.com/bid/7637 来源: MANDRAKE 名称: MDKSA-2003:062 链接:http://www.mandriva.com/security/advisories?name=MDKSA-2003:062 来源: BUGTRAQ 名称: 20030529 [slackware-security] CUPS DoS vulnerability fixed (SSA:2003-149-01) 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105427288724449&w=2 来源: CONECTIVA 名称: CLSA-2003:678 链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000678 来源: US Government Resource: oval:org.mitre.oval:def:6 名称: oval:org.mitre.oval:def:6 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6

受影响实体

• Slackware Slackware_linux:8.1  
• Slackware Slackware_linux:9.0  

补丁

暂无