Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2012-5519

Published: 19 November 2012

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Notes

AuthorNote
mdeslaur
On Ubuntu, file disclosure and corruption is limited by the
AppArmor profile, which limits exposure. It still can access
some important files though, such as /etc/shadow.

Upstream patch moves dangerous configuration options to a
second config file which is not web-editable. Although this is
a good long-term solution, the changes are too intrusive for a
security update. The most sensible thing to do at this time is
to completely disable modifying the cupsd.conf file via the web
interface.

Priority

Medium

Status

Package Release Status
cups
Launchpad, Ubuntu, Debian
upstream Needs triage

hardy Does not exist

lucid
Released (1.4.3-1ubuntu1.9)
oneiric
Released (1.5.0-8ubuntu7.3)
precise
Released (1.5.3-0ubuntu5.1)
quantal
Released (1.6.1-0ubuntu11.3)
Patches:
vendor: http://www.debian.org/security/2013/dsa-2600
cupsys
Launchpad, Ubuntu, Debian
upstream Needs triage

hardy
Released (1.3.7-1ubuntu3.16)
lucid Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist