DRAFT - CUPS Software Security Report


CUPS-SSR-1.0
Easy Software Products
Copyright 1997-1999, All Rights Reserved

Table of Contents



1 Scope 2 References 3 Local Access Risks 4 Remote Access Risks A Glossary
GIF89a¯ÿòÌÌÌ™™™fff333ÿÿÿÿÿÿÿÿÿ!ù,¯ÿBþXºÜþ0ÊI«½8ëÍ»ÿ`(Ždižhª2€0p,Ïtmßx®ï ;±Ýíˆndý !¸ ž³wà…MƒƒY~¿{,gÚ\‚äé Œ×Ø(tÙî!Ï=Ñ.ûz¯áÑŸ:ì;Ã9qöíÉë]/¿ºÉ¤Et/†'Îþt9ÀØ–ž_ÙÇ\|W•wArö¸Ý2Ô× tN°0Tï}¡û‰$!‚yMxî)ˆš‰Ôø@nB°U½ÊwE„§!ŠF H L8B c‰;ždŠ-æDVWdг€h±äÚ“P¶%#(4Fiå•Ï\hŠ:Re!\ÒÄ—X^¦%€¥À-$E€Ö/úHŽšlââöÌQX ¸1Nô¯b"œŠüjåÁÂE0…È8ö5GkZ|ÒÁwt„C»ÔQSÇo6ÔÙ[W„$²*Ž+4Pb-8¹P1þ'8"‘ФÄ$ Cyê‘„)>ãŠtè`Ð3‡‹¾z"«rE'Âqfä°Ë ‘qÂ\|€„Ž¡ôö»%É(.—bڽȀíÉ`{¬EÇ1w’ »[Hß`(B6ö“  †')ÊRŽÎa[ÃrbC!Tå°Œ 2Q·ÈHZê#–®üË/àô¯FÝê(Û²% ºXË9öÀbÁ4f.ù-oý™XËB…IÎÒ7¹*@ÃÓŽÍT€hà‘ÌWâ™Ã$f:µyžn†ó†r„'téKv` Ç+dª– œ79sò|'=×¢Ìx¶òœÿ„¦œˆeÎ;*à$þ” IÝÆaÏ{–3ŽÅÁ P“ÍS[ÙL¨3©òQ7éÆò#ãûô0F×ðsE°t§@‘ØQÜ´´ ©:3ÓRíd ¥*MITnŒ£¨H]ØQÁd @òþ—¬rMœŽaO rë^yÀ·(¸îéêû$uDòrã/a,I.°ÙUÀœb hˆ`¾B ë" Ü`HØxȸo1þ[á\8f^æ|\ý‚¢¢zø0(ˆ\ {ƒÄgäÞõ€çâ§Á˜0*\³n¼‹m¶/Äeª±ÿ†ì Ç,½DN2€œº+ùÉ|í0L¡Le*ð¸Ã>­2ëf,eIPOËÅàr—±”80SAŸcFªatç»ãy¤¸ršçÌ¡5ïoõËsžï|¿8˙Φ¬þ,ï¼èà)ÁÌ;øk¡—†dDpÑòø2¢qfHã!Ë“~ÙŸ-í 'g:,æ4y?ýäP‹Z›ž#ÏÕ´Î5AK‰k]ûš›ÒKõ¯‡më€õzØÈƫ؎Ý>B{PЪ.6hf]º?©ÌIŽuO„íM‚ÌÇÜcµ3˜ 61‹NÒ[†W£ ¦m¿­{ÂPâvζKnUˆ[ ònĽ±÷n?l:Áž3ušë¬sP[ÿnn¾çP…WõÔFj[Â÷ ¹vÏ™à‰˜xú'ˆ£ÀÀ†p¸4.êãKÇ¿ÂÁ±o§¢ü"Á|Nk`îʘ  jl©ÌuˆËi™0pmC´«+‰÷6¤2­éÏe`(ŽJ]¥iõð3ƒØí"p|ª!:qøFس 6£ @­,þŠqüãoÌÇ®žÖüV“¶QÇ›Evî¹²É8ÙªS"æÀç‡x± àþ‡>—Iãg ïÝ>Y‰çN80æ§ ±¾GLLìÕµ…(1Þ¼!8}þ¬“*…ª‰Ùì:e»´œ ª¿ên_6ÂÃSÀ`eG;Ö„CƒCcˆ¿‡4¸yeî¯Í)oøByRm½0?íLîÅ`QÿjÓÙ/ºôÓN|Ý þÙAÜŒÁ¸D5©D aævx ?жx°DM@•!h‰àÈ€Ž§® • á×B`ð¤ªE?›“”Þdƒ"8$Ý`Ki0…OðƒnΓ±µvtžè€I([,¹Ndɨh\'6X Pã—Š‰Éøt ¢‘¥˜¬è €ˆ†Ky™FˆŒë`š”yƒ„¨š €š‰ƒM©‡øFQhY„ 9¶X¯×–í4š¤™Y\)"¹AN]‰xéz÷Gq07)©ñ™•Y€r°ŒŽi‹ z ™ÇäFÍÉT–ù› ËŽC œwI›üX]‹¹\ëY]þf lïYbj8ŸÈuœbŸÍÅtú©fÞןfBI—“*øé:ÛØUj Ò ˆõ¹ Õp $(~ ¡Ú ¡gù{îpZI?¡ƒîÀv:“a¦˜6¢§Ô]Ý‘(ªê)!ŸÚ¢: jwµ¡4ÚvíHÛǘ9ºXhó•üù£¥Á¢VÉ{Dº2š‰(°¤3š¤a÷ +У¥“p¢þò4Vº—  E´¥è¤k°7ºhT*€¿èw`ÚžiÄ …S¦Ʀmê Nêƒ#ú¢f€ xê†ý 8z©7uÚp{Ú=~]7`«h‡ÚsÚg:…zd˜ó§ÎA-vþAñr¦'–AÚ)9–š¢âSi;£…š 1ªo"ª ¦J;“º rº8Ui|é>¡Úœú “ë¥Dfný2»ƒ–0j«®»ºK;zë¢Íö»—!µ—S»³r>K+6ˆ‹¨XÒ»; CÈ 8Ê;¢»ÃÛ/Œ‹¥ž!¬s½VR½óõÏ‹Oâ[/çK¨þ˜Ñ:Í‹\Ý+ Sc:ïËž’º¶ë9Æ» ô 8ly$ 8©ÙÅmX2Ùh>—?¯!šHüÁ^LsP,Ÿ«Y‹âá¿ÿtšì‚£Y r¦Éš¥9ÇjžÄ8-ÆÇŒ¶iêPÂbA˜ù‰Ã¸š»³7RœCWRoìŠå MŒŠ”åt™ Œ›réÉq å>}Lê}ÎǨ 5:àŒ|"þÇwÐsøæNΰ¹#R>~-N‰®èƒ ßcðÞÚÎÑ¥®åGÎâ툉Ýè*‚¸ =‚ž ºëâ…­ëÀ>Û·žën^žmèÊëð¼ã>å×Λ«}êØ÷ “Œ¬ËIÁ·AÔNÍëv>]t.âÚLЫþíï¾ñnäÖÜæs¹¿±â°+† ¬UØïî•.ç¬ÎìÍ.è´ÞŠG=ðù‚§ž¯”ë^äÛ®êh-‹êê!i!ÕvMíiªîþ¾òîá/þÑ-OÖGð,oñº!å’gOâ POìOôBþÈàhâ+?ï>ßÊVHÀsaõ™€õ$óSîõ—»ó8.žß¹ ~áßÈ©ö»]ò3ëÆt_÷[ïôb¯ç‚Ü÷Õ«@u™ð;zܘ‘Ü@óŽ2’?ùƒ¸ÙlùF ¶™¯ù›N ž0œú£¶¤ÿ0#9:ß§½ž©Ÿ\#ÃÙæó2é+û‚ÀÓ¸_äM/ÓtaÚý3”]Ù«¿¸iîaF>ª}ŒØvÍïMÍ÷Ðëä©îrÜŒöqñ_ÀüªrâF®ò ýþ¸—hT_ã4sx”ýÝî)ç.QgûàŸÏ%ì‹}i´ASû|þð@QÜ $J9€»-̱÷ÜôMØ‘hZ˜¦:°œ*ÏlßxÒ|ϼ¡ÅLÀ ¬Áfù9BÑdìÁ|«VV„¢“énKv kB_ƒg 3ʳ8#Þ¬L=0;J¤äÈ@¤F|'i~±© žaÊŠÆg;d*3²”©bPÏ¢TäHô¦?[† ÄäƒhN6ZM¢D:c*BR!$±ckƒ’V­-uÛ@[øp„Ÿ]¼8ö-1{TήWÏ2ñ Šp=¸q«Ñ½es.‰„4+#Ëe¦¥W5µekxr䛓/XÍš5Iǃ=kÝúµì˰ûN–2qŦyZ£QŽ›ÇÞtxŠäcK—Ííɹ iþ¡9¼m1oñ¢©/²8îìSté4l’Wm¾9óéÖÛÐãã{{üzÞ¿çøêöÞzà}œàL¨ "˜ ÄÐsà¶PGLUúå`MÞ  ¡†9¬§Û{pX¸¡wÚw߇¡¨ ‰í "MUXNx +l´á¦ j²F:Á.êÆÛj¤³Búî ¼Ê«/£Ö’[н#í+ð¥ænJÞ¸«æ;ð©õ‹¨ _ËðÄŠÒ»*º? ƒÂwœÃyzh±°Øzl2,#oZ2È›r|òË‚°¼$Ç)ë óÍÙÔ,éfs€1Î@/øîÏPõÌiÐH·ðÃBkLtÒP¯bôS;NÝWÔXÏ ó’dlÍtÖ`°tžOc óÅa§}AÄ›²1vËjÇmþu+`ÍÍÁ·qwü6˜‚ì½sÞXŸ¨Ë$xM6àP³-iÉSÚ½AÙˆïë84–ø=xä8^!ä*L>Þ˜ƒk¹Œ({Iè^!ḘN$ê «®ç!ºû‚ÿÝ ë¯ßoî—Oü¨¾ÿî9í]ñÞ{ñÙÊ®ãlhŽ(èÌÃê¼~ÔS¢|öÕŸzýw¬Ë§|øÝ—*½ŒÈ×­|úåwzþæ“)Nrû¾Ê?*ô¥ ¿*÷ô7ú½~Múúú÷ª÷Ɉ•S3x*ûíP”ùH£°°àó(è¾í-Jƒú™ åAF{#\”g…Áœ)!),Ô #ÓÂǼjþ1œŒþh©²K„9$ƒYè)Ž ˆA È —‡)#1‰Óp"˜ð'Ã%n‰P´‡Ù¨-‹1³¢^\%ƈÔp„CLÖ5Ã

1 Scope

1.1 Identification

This software security report provides an analysis of possible security concerns for the Common UNIX Printing System ("CUPS") Version 1.0.

1.2 System Overview

The Common UNIX Printing System provides a portable printing layer for UNIX® operating systems. It has been developed by Easy Software Products to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces.

CUPS uses the Internet Printing Protocol (IETF-IPP) as the basis for managing print jobs and queues. The Line Printer Daemon (LPD, RFC1179), Server Message Block (SMB), and AppSocket protocols are also supported with reduced functionality.

CUPS adds network printer browsing and PostScript Printer Description ("PPD")-based printing options to support real world applications under UNIX.

CUPS also includes a customized version of GNU GhostScript (currently based off GNU GhostScript 4.03) and an image file RIP that can be used to support non-PostScript printers.

1.3 Document Overview

This software security report is organized into the following sections:

2 References

2.1 CUPS Documentation

The following CUPS documentation is referenced by this document:

2.2 Other Documents

The following non-CUPS documents are referenced by this document:

3 Local Access Risks

Local access risks are those that can be exploited only with a local user account. This section does not address issues related to dissemination of the root password or other security issues associated with the UNIX operating system.

3.1 Security Breaches

There are two known security vulnerabilities with local access:

  1. Since the default installation creates a world-readable request directory, it is possible for local users to read the contents of print files before they are printed.

    This problem can be alleviated by making the request directory readable only by the user specified in the CUPS configuration file.

  2. Device URIs are passed to backend filters in argv[0] and in an environment variable. Since device URIs can contain usernames and passwords it may be possible for a local user to gain access to a remote resource.

    We recommend that any password-protected accounts used for remote printing have limited access priviledges so that the possible damages can be minimized.

    The device URI is "sanitized" (the username and password are removed) when sent to an IPP client so that a remote user cannot exploit this vulnerability.

4 Remote Access Risks

Remote access risks are those that can be exploited without a local user account and/or from a remote system. This section does not address issues related to network or firewall security.

4.1 Denial of Service Attacks

Like all Internet services, the CUPS server is vulnerable to denial of service attacks, including:

  1. Establishing multiple connections to the server until the server will accept no more.

    This cannot be protected against by the current software. It is possible that future versions of the CUPS software could be configured to limit the number of connections allowed from a single host, however that still would not prevent a determined attack.

  2. Repeatedly opening and closing connections to the server as fast as possible.

    There is no easy way of protecting against this in the CUPS software. If the attack is coming from outside the local network it might be possible to filter such an attack, however once the connection request has been received by the server it must at least accept the connection to find out who is connecting.

  3. Flooding the network with broadcast packets on port 631.

    It might be possible to disable browsing if this condition is detected by the CUPS software, however if there are large numbers of printers available on the network such an algorithm might think that an attack was occurring when instead a valid update was being received.

  4. Sending partial IPP requests; specifically, sending part of an attribute value and then stopping transmission.

    The current code is structured to read and write the IPP request data on-the-fly, so there is no easy way to protect against this for large attribute values.

  5. Sending large/long print jobs to printers, preventing other users from printing.

    There are limited facilities for protecting against large print jobs (the MaxRequestSize attribute), however this will not protect printers from malicious users and print files that generate hundreds or thousands of pages. In general, we recommend restricting printer access to known hosts or networks, and adding user-level access control as needed for expensive printers.

4.2 Security Breaches

The current CUPS server only supports Basic authentication with usernames and passwords. This essentially places the clear text of the username and password on the network. Since CUPS uses the UNIX username and password account information, the authentication information could be used to gain access to accounts (possibly priviledged accounts) on the server.

The default CUPS configuration disables remote administration. We do not recommend that remote administration be enabled for all hosts, however if you have a trusted network or subnet access can be restricted accordingly.

The next minor release of CUPS will support Digest authentication of the entire message body using separate MD5-based username and password files. This will protect password information and prevent unauthorized access due to compromised account passwords.

A Glossary

A.1 Terms

C
A computer language.
parallel
Sending or receiving data more than 1 bit at a time.
pipe
A one-way communications channel between two programs.
serial
Sending or receiving data 1 bit at a time.
socket
A two-way network communications channel.

A.2 Acronyms

ASCII
American Standard Code for Information Interchange
CUPS
Common UNIX Printing System
ESC/P
EPSON Standard Code for Printers
FTP
File Transfer Protocol
HP-GL
Hewlett-Packard Graphics Language
HP-PCL
Hewlett-Packard Printer Control Language
HP-PJL
Hewlett-Packard Printer Job Language
IETF
Internet Engineering Task Force
IPP
Internet Printing Protocol
ISO
International Standards Organization
LPD
Line Printer Daemon
MIME
Multimedia Internet Mail Exchange
PCL
Page Control Language
PPD
PostScript Printer Description
SMB
Server Message Block
TFTP
Trivial File Transfer Protocol