oss-security - Re: CVE request: CUPS DoS via RSS subscriptions

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 21 Nov 2008 07:23:24 -0800
From: Michael Sweet <mike@...ysw.com>
To: Eygene Ryabinkin <rea-sec@...elabs.ru>
CC: oss-security@...ts.openwall.com, 
 "Steven M. Christey" <coley@...re.org>
Subject: Re: CVE request: CUPS DoS via RSS subscriptions

Eygene Ryabinkin wrote:
> Steve, good day.
> 
> Thu, Nov 20, 2008 at 07:41:06PM -0500, Steven M. Christey wrote:
>> I treated this as two CVEs, one for the CSRF-simplifying attack, and a
>> separate one for the CUPS server crash (assuming that cupsd should not be
>> crashable by non-root authenticated users).
> 
> Please note that as it was discuissed in thread started with
>   http://www.openwall.com/lists/oss-security/2008/11/19/4
> even 1.3.9 is crashable by non-root authenticated users by adding
> a big number of subscriptions (don't know about RSS ones, though
> subscription for mailing upon job completion does its job).  But
> I imagine that CVE-2008-5184 can't be used for 1.3.9, so remote
> attack is not feasible.
> 
> I expect that the fix will go into 1.3.10:
>   http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt
> 
> Adding Michael Sweet to the CC, since he can shed a bit more light on
> this matter.  Perhaps CVE-2008-5183 should be extended or another CVE
> can be created.

While they are related, since half of the issue has already been
addressed it would probably be less confusing (for tracking purposes)
to create another CVE for the too-many-subscriptions issue (which is
what my patch addresses...)

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products           mike at easysw dot com

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.