1. Ubuntu Security Notices
  2. USN-856-1

USN-856-1: CUPS vulnerability

Publication date

10 November 2009

Overview

CUPS vulnerability

Releases

Packages

Details

Aaron Sigel discovered that the CUPS web interface incorrectly protected
against cross-site scripting (XSS) and cross-site request forgery (CSRF)
attacks. If an authenticated user were tricked into visiting a malicious
website while logged into CUPS, a remote attacker could modify the CUPS
configuration and possibly steal confidential data.

Aaron Sigel discovered that the CUPS web interface incorrectly protected
against cross-site scripting (XSS) and cross-site request forgery (CSRF)
attacks. If an authenticated user were tricked into visiting a malicious
website while logged into CUPS, a remote attacker could modify the CUPS
configuration and possibly steal confidential data.

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic cups –  1.4.1-5ubuntu2.1
9.04 jaunty cups –  1.3.9-17ubuntu3.4
8.10 intrepid cups –  1.3.9-2ubuntu9.3
8.04 hardy cupsys –  1.3.7-1ubuntu3.6
6.06 dapper cupsys –  1.2.2-0ubuntu0.6.06.15

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›