oss-sec mailing list archives
Privilege escalation (lpadmin -> root) in cups
From: Yves-Alexis Perez <corsac () debian org>
Date: Sat, 10 Nov 2012 13:49:43 +0100
Hi, a Debian user reported a bug in our BTS concerning cupsd. The bug is available at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692791 and upstream bug at http://www.cups.org/str.php?L4223 (restricted because it's tagged security). I'm unsure right now if it's an upstream issue or specific to Debian. Basically, members of the lpadmin group (which is the group having admin rights to cups, meaning they're supposed to be able to add/remove printeers etc.) have admin access to the web interface, where they can edit the config file and set some “dangerous” directives (like the log filenames), which enable them to read or write files as the user running the cupsd webserver. In Debian case at least, it's run as root, meaning we have a privilege escalation issue from lpadmin group to root. A fix would be to not run cupsd web server as root, and maybe to restrict it to some kind of chroot so it doesn't have access to sensitive files Can a CVE be allocated for this? Regards, -- Yves-Alexis
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Privilege escalation (lpadmin -> root) in cups Yves-Alexis Perez (Nov 10)
- Re: Privilege escalation (lpadmin -> root) in cups Yves-Alexis Perez (Nov 10)
- Re: Privilege escalation (lpadmin -> root) in cups Yves-Alexis Perez (Nov 11)
- Re: Privilege escalation (lpadmin -> root) in cups Kurt Seifried (Nov 10)
- Re: Privilege escalation (lpadmin -> root) in cups Yves-Alexis Perez (Nov 11)
- Re: Privilege escalation (lpadmin -> root) in cups Sean Amoss (Nov 13)
- Re: Privilege escalation (lpadmin -> root) in cups Yves-Alexis Perez (Nov 10)