Vulnerability Note VU#557062

CUPS stores user account details in plain text in log file

Overview

When an SMB printer is configured, CUPS stores plain text login information to the log file.

I. Description

CUPS is a cross-platform printing system for UNIX environments. It can use the IPP, LPD, SMB, and JetDirect protocols to interact with printers. The SMB protocol is used to communicate with printers that are shared via Microsoft Windows or other SMB-compatible software such as Samba. When an SMB printer is added or modified, the connection string for the printer is written to the log file in plain text. This connection string will contain a username and password if authentication is required for the printer.

II. Impact

A local authenticated user may be able to retrieve the usernames and passwords for other accounts.

III. Solution

Apply a patch from your vendor

For vendor-specific information regarding vulnerable status and patch availability, please see the Systems Affected section of this document.

Upgrade your version of CUPS

This issue is resolved in CUPS 1.1.22rc1. Starting with this version, the connection string for the printer is sanitized so that it does not contain sensitive information.

Restrict access to the CUPS log file

By default, the CUPS log file is world-readable. Access to the CUPS log file can be restricted by setting the LogFilePerm option in cupsd.conf to "0600"

Do not use authenticated printing to Windows via Samba

Because of the possibility of disclosing sensitive information when using a printer shared via SMB, it is suggested to use other protocols such as LPD. Windows can function as an LPD server when Print Services for UNIX is installed.

Systems Affected

Vendor	Status	Date Notified
BSDI	Unknown	4-Oct-2004
Conectiva	Unknown	4-Oct-2004
Cray Inc.	Unknown	4-Oct-2004
Debian	Vulnerable	18-Oct-2004
EMC Corporation	Unknown	4-Oct-2004
Engarde	Unknown	4-Oct-2004
F5 Networks	Unknown	4-Oct-2004
FreeBSD	Unknown	4-Oct-2004
Fujitsu	Unknown	4-Oct-2004
Hewlett-Packard Company	Unknown	4-Oct-2004
Hitachi	Not Vulnerable	8-Oct-2004
IBM	Unknown	4-Oct-2004
IBM-zSeries	Unknown	4-Oct-2004
IBM eServer	Unknown	4-Oct-2004
Immunix	Unknown	4-Oct-2004
Ingrian Networks	Unknown	4-Oct-2004
Juniper Networks	Unknown	4-Oct-2004
MandrakeSoft	Vulnerable	22-Oct-2004
MontaVista Software	Unknown	4-Oct-2004
NEC Corporation	Unknown	4-Oct-2004
NETBSD	Not Vulnerable	5-Oct-2004
Nokia	Unknown	4-Oct-2004
Novell	Unknown	4-Oct-2004
OpenBSD	Unknown	4-Oct-2004
Openwall GNU/*/Linux	Unknown	4-Oct-2004
Red Hat Inc.	Unknown	4-Oct-2004
SCO	Unknown	4-Oct-2004
Sequent	Unknown	4-Oct-2004
SGI	Unknown	28-Oct-2004
Sony Corporation	Unknown	4-Oct-2004
Sun Microsystems Inc.	Unknown	4-Oct-2004
SuSE Inc.	Unknown	4-Oct-2004
TurboLinux	Unknown	4-Oct-2004
Unisys	Unknown	4-Oct-2004
Wind River Systems Inc.	Unknown	4-Oct-2004

References

http://www.securitytracker.com/alerts/2004/Oct/1011529.html
http://secunia.com/advisories/12736/
http://fedoranews.org/updates/FEDORA-2004-331.shtml
http://www.cups.org/ssr.html

Credit

Thanks to Gary Smith for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

Date Public:	2004-10-05
Date First Published:	2004-11-19
Date Last Updated:	2004-12-17
CERT Advisory:
CVE-ID(s):	CAN-2004-0923
NVD-ID(s):	CAN-2004-0923
US-CERT Technical Alerts:
Metric:	5.06
Document Revision:	17

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader