Vulnerability Note VU#557062

CUPS stores user account details in plain text in log file

Original Release date: 19 Nov 2004 | Last revised: 17 Dec 2004

Overview

When an SMB printer is configured, CUPS stores plain text login information to the log file.

Description

CUPS is a cross-platform printing system for UNIX environments. It can use the IPP, LPD, SMB, and JetDirect protocols to interact with printers. The SMB protocol is used to communicate with printers that are shared via Microsoft Windows or other SMB-compatible software such as Samba. When an SMB printer is added or modified, the connection string for the printer is written to the log file in plain text. This connection string will contain a username and password if authentication is required for the printer.

Impact

A local authenticated user may be able to retrieve the usernames and passwords for other accounts.

Solution

Apply a patch from your vendor

For vendor-specific information regarding vulnerable status and patch availability, please see the Systems Affected section of this document.


Upgrade your version of CUPS

This issue is resolved in CUPS 1.1.22rc1. Starting with this version, the connection string for the printer is sanitized so that it does not contain sensitive information.

Restrict access to the CUPS log file

By default, the CUPS log file is world-readable. Access to the CUPS log file can be restricted by setting the LogFilePerm option in cupsd.conf to "0600"

Do not use authenticated printing to Windows via Samba

Because of the possibility of disclosing sensitive information when using a printer shared via SMB, it is suggested to use other protocols such as LPD. Windows can function as an LPD server when Print Services for UNIX is installed.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
DebianAffected04 Oct 200418 Oct 2004
MandrakeSoftAffected04 Oct 200422 Oct 2004
HitachiNot Affected04 Oct 200408 Oct 2004
NETBSDNot Affected04 Oct 200405 Oct 2004
BSDIUnknown04 Oct 200404 Oct 2004
ConectivaUnknown04 Oct 200404 Oct 2004
Cray Inc.Unknown04 Oct 200404 Oct 2004
EMC CorporationUnknown04 Oct 200404 Oct 2004
EngardeUnknown04 Oct 200404 Oct 2004
F5 NetworksUnknown04 Oct 200404 Oct 2004
FreeBSDUnknown04 Oct 200404 Oct 2004
FujitsuUnknown04 Oct 200404 Oct 2004
Hewlett-Packard CompanyUnknown04 Oct 200404 Oct 2004
IBMUnknown04 Oct 200404 Oct 2004
IBM-zSeriesUnknown04 Oct 200404 Oct 2004
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Gary Smith for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

  • CVE IDs: CAN-2004-0923
  • Date Public: 05 Oct 2004
  • Date First Published: 19 Nov 2004
  • Date Last Updated: 17 Dec 2004
  • Severity Metric: 5.06
  • Document Revision: 17

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.