Arch Linux Security Advisory ASA-201506-2
========================================
Severity: Critical
Date    : 2015-06-10
CVE-ID  : CVE-2015-1158 CVE-2015-1159
Package : cups
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package cups before version 2.0.3-1 is vulnerable to multiple issues
including arbitrary code execution, privilege escalation and cross-side
scripting.

Resolution
=========
Upgrade to 2.0.3-1.

# pacman -Syu "cups>=2.0.3-1"

The problems have been fixed upstream in version 2.0.3.

Workaround
=========
None.

Description
==========
- CVE-2015-1158 (arbitrary code execution, privilege escalation)

An issue with how localized strings are handled in cupsd allows a
reference counter to over-decrement when handling certain print job
request errors. As a result, an attacker can prematurely free an
arbitrary string of global scope, creating a dangling pointer to a
repurposed block of memory on the heap. The dangling pointer causes ACL
verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL
handling failure results in unrestricted access to privileged
operations, allowing an unauthenticated remote user to upload a
replacement CUPS configuration file and mount further attacks.

- CVE-2015-1159 (cross-side scripting)

A cross-site scripting bug in the CUPS templating engine allows this bug
to be exploited when a user browses the web. In certain cases, the CGI
template can echo user input to file rather than escaping the text
first. This may be used to set up a reflected XSS attack in the QUERY
parameter of the web interface help page. By default, many linux
distributions run with the web interface activated.

Impact
=====
A remote attacker is able to use a cross-side scripting flaw in order to
send a malicious print request that is leading to arbitrary code
execution and privilege escalation.

References
=========
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159
https://bugs.archlinux.org/task/45279