Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2005.1002 -- [UNIX/Linux][RedHat] Important: cups security update 21 December 2005 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: CUPS Publisher: Red Hat Operating System: Red Hat Desktop 3 Red Hat Enterprise Linux AS/ES/WS 3 Red Hat Enterprise Linux Desktop 4 Red Hat Enterprise Linux AS/ES/WS 4 UNIX variants (UNIX, Linux, OSX) Impact: Execute Arbitrary Code/Commands Denial of Service Access: Remote/Unauthenticated CVE Names: CVE-2005-3193 CVE-2005-3192 CVE-2005-3191 Ref: ESB-2005.1000 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2005-878.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: cups security update Advisory ID: RHSA-2005:878-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-878.html Issue date: 2005-12-20 Updated on: 2005-12-20 Product: Red Hat Enterprise Linux CVE Names: CVE-2005-3191 CVE-2005-3192 CVE-2005-3193 - - --------------------------------------------------------------------- 1. Summary: Updated CUPS packages that fix multiple security issues are now available for Red Hat Enterprise Linux. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Several flaws were discovered in the way CUPS processes PDF files. An attacker could construct a carefully crafted PDF file that could cause CUPS to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, and CVE-2005-3193 to these issues. All users of CUPS should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 175645 - CVE-2005-3193 xpdf issues (CVE-2005-3191 CVE-2005-3192) 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/cups-1.1.17-13.3.34.src.rpm 5053f756d66be461123f8f31ed613588 cups-1.1.17-13.3.34.src.rpm i386: 6ae0b5bb5a2e0163ae2a3ced2578f454 cups-1.1.17-13.3.34.i386.rpm 8286175d3e766671964412c5e64a9cc2 cups-devel-1.1.17-13.3.34.i386.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm ia64: 2b5227adaa4067c3ae00123b111ec202 cups-1.1.17-13.3.34.ia64.rpm bc4eb43419e0914d27ae7e28272fbc62 cups-devel-1.1.17-13.3.34.ia64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm 4130b86879fd4560b8ce7425415f50de cups-libs-1.1.17-13.3.34.ia64.rpm ppc: 36b424532fa9e47ec5464d2ce3ddee9c cups-1.1.17-13.3.34.ppc.rpm 6dd01d61c3a8245ce2f9b4aa93a404f6 cups-devel-1.1.17-13.3.34.ppc.rpm 95798e222ce9388ca26d52306d91bf79 cups-libs-1.1.17-13.3.34.ppc.rpm 4119d70822a8b14b70d0693adcc24a84 cups-libs-1.1.17-13.3.34.ppc64.rpm s390: 50cb26f6a50c17e5832e1b2729429920 cups-1.1.17-13.3.34.s390.rpm 9285ffc9691aae167241b80cd191cf4b cups-devel-1.1.17-13.3.34.s390.rpm 3a97374955e71eb48fd249fd67ec07a4 cups-libs-1.1.17-13.3.34.s390.rpm s390x: 848068e7af6be3c449ec8727ffc4c096 cups-1.1.17-13.3.34.s390x.rpm d286c2a1183a0e51abbf1d5190b8ec16 cups-devel-1.1.17-13.3.34.s390x.rpm 3a97374955e71eb48fd249fd67ec07a4 cups-libs-1.1.17-13.3.34.s390.rpm d88f8c43f5e4037a0a2d0abb328b54a5 cups-libs-1.1.17-13.3.34.s390x.rpm x86_64: 101cb50eb0d1c5af24a4706fd9366827 cups-1.1.17-13.3.34.x86_64.rpm 44c3d1ccbdaa8f3b388815f77eff86f9 cups-devel-1.1.17-13.3.34.x86_64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm be321cf14f72587d6fb9aeea6f3cd4b0 cups-libs-1.1.17-13.3.34.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/cups-1.1.17-13.3.34.src.rpm 5053f756d66be461123f8f31ed613588 cups-1.1.17-13.3.34.src.rpm i386: 6ae0b5bb5a2e0163ae2a3ced2578f454 cups-1.1.17-13.3.34.i386.rpm 8286175d3e766671964412c5e64a9cc2 cups-devel-1.1.17-13.3.34.i386.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm x86_64: 101cb50eb0d1c5af24a4706fd9366827 cups-1.1.17-13.3.34.x86_64.rpm 44c3d1ccbdaa8f3b388815f77eff86f9 cups-devel-1.1.17-13.3.34.x86_64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm be321cf14f72587d6fb9aeea6f3cd4b0 cups-libs-1.1.17-13.3.34.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/cups-1.1.17-13.3.34.src.rpm 5053f756d66be461123f8f31ed613588 cups-1.1.17-13.3.34.src.rpm i386: 6ae0b5bb5a2e0163ae2a3ced2578f454 cups-1.1.17-13.3.34.i386.rpm 8286175d3e766671964412c5e64a9cc2 cups-devel-1.1.17-13.3.34.i386.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm ia64: 2b5227adaa4067c3ae00123b111ec202 cups-1.1.17-13.3.34.ia64.rpm bc4eb43419e0914d27ae7e28272fbc62 cups-devel-1.1.17-13.3.34.ia64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm 4130b86879fd4560b8ce7425415f50de cups-libs-1.1.17-13.3.34.ia64.rpm x86_64: 101cb50eb0d1c5af24a4706fd9366827 cups-1.1.17-13.3.34.x86_64.rpm 44c3d1ccbdaa8f3b388815f77eff86f9 cups-devel-1.1.17-13.3.34.x86_64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm be321cf14f72587d6fb9aeea6f3cd4b0 cups-libs-1.1.17-13.3.34.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/cups-1.1.17-13.3.34.src.rpm 5053f756d66be461123f8f31ed613588 cups-1.1.17-13.3.34.src.rpm i386: 6ae0b5bb5a2e0163ae2a3ced2578f454 cups-1.1.17-13.3.34.i386.rpm 8286175d3e766671964412c5e64a9cc2 cups-devel-1.1.17-13.3.34.i386.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm ia64: 2b5227adaa4067c3ae00123b111ec202 cups-1.1.17-13.3.34.ia64.rpm bc4eb43419e0914d27ae7e28272fbc62 cups-devel-1.1.17-13.3.34.ia64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm 4130b86879fd4560b8ce7425415f50de cups-libs-1.1.17-13.3.34.ia64.rpm x86_64: 101cb50eb0d1c5af24a4706fd9366827 cups-1.1.17-13.3.34.x86_64.rpm 44c3d1ccbdaa8f3b388815f77eff86f9 cups-devel-1.1.17-13.3.34.x86_64.rpm 881034b340bd7fe9ac3d34cd9d269195 cups-libs-1.1.17-13.3.34.i386.rpm be321cf14f72587d6fb9aeea6f3cd4b0 cups-libs-1.1.17-13.3.34.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/cups-1.1.22-0.rc1.9.9.src.rpm d718800ea8bb89d10541219c418a1e5e cups-1.1.22-0.rc1.9.9.src.rpm i386: f750dba7bddeed26ad1246a13d67b4cc cups-1.1.22-0.rc1.9.9.i386.rpm 75f3d226a45dc479659d3d8a841d92b0 cups-devel-1.1.22-0.rc1.9.9.i386.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm ia64: fce05f1785514904e476428c143cacbf cups-1.1.22-0.rc1.9.9.ia64.rpm ebf3ca248025a33cbb432f3f51dac1f3 cups-devel-1.1.22-0.rc1.9.9.ia64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm d673d6538e126c4374be81bf513000f2 cups-libs-1.1.22-0.rc1.9.9.ia64.rpm ppc: 01c56000521d94ec20114c5d2fc9352a cups-1.1.22-0.rc1.9.9.ppc.rpm 5feab7e486e2044e721dcfe189564367 cups-devel-1.1.22-0.rc1.9.9.ppc.rpm eaf2422032dc92e48bcd8edaefe2bd30 cups-libs-1.1.22-0.rc1.9.9.ppc.rpm f826ff1b99dd00a120123eda6bcc3890 cups-libs-1.1.22-0.rc1.9.9.ppc64.rpm s390: f5ba40ec0ca7ec1e299ba2e83a54418a cups-1.1.22-0.rc1.9.9.s390.rpm fc53e26073e8c43f3bef1b35f23ec242 cups-devel-1.1.22-0.rc1.9.9.s390.rpm 59f346d414766d86c69fc8ef135b2ce8 cups-libs-1.1.22-0.rc1.9.9.s390.rpm s390x: 1cd6f5df3663a21dce64c3a84d96f2ed cups-1.1.22-0.rc1.9.9.s390x.rpm 16c8b331fd9484161427aa3f2bca5bfe cups-devel-1.1.22-0.rc1.9.9.s390x.rpm 59f346d414766d86c69fc8ef135b2ce8 cups-libs-1.1.22-0.rc1.9.9.s390.rpm d14b17dee1958bf7dcd105f1997b515b cups-libs-1.1.22-0.rc1.9.9.s390x.rpm x86_64: 8930858f2aa35547ef280ca80b2fbbf1 cups-1.1.22-0.rc1.9.9.x86_64.rpm 1451d04888bb8285c4eff2f39843dcf9 cups-devel-1.1.22-0.rc1.9.9.x86_64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm 0663930f0ad6bb3648c71ab252c7e37d cups-libs-1.1.22-0.rc1.9.9.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/cups-1.1.22-0.rc1.9.9.src.rpm d718800ea8bb89d10541219c418a1e5e cups-1.1.22-0.rc1.9.9.src.rpm i386: f750dba7bddeed26ad1246a13d67b4cc cups-1.1.22-0.rc1.9.9.i386.rpm 75f3d226a45dc479659d3d8a841d92b0 cups-devel-1.1.22-0.rc1.9.9.i386.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm x86_64: 8930858f2aa35547ef280ca80b2fbbf1 cups-1.1.22-0.rc1.9.9.x86_64.rpm 1451d04888bb8285c4eff2f39843dcf9 cups-devel-1.1.22-0.rc1.9.9.x86_64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm 0663930f0ad6bb3648c71ab252c7e37d cups-libs-1.1.22-0.rc1.9.9.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/cups-1.1.22-0.rc1.9.9.src.rpm d718800ea8bb89d10541219c418a1e5e cups-1.1.22-0.rc1.9.9.src.rpm i386: f750dba7bddeed26ad1246a13d67b4cc cups-1.1.22-0.rc1.9.9.i386.rpm 75f3d226a45dc479659d3d8a841d92b0 cups-devel-1.1.22-0.rc1.9.9.i386.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm ia64: fce05f1785514904e476428c143cacbf cups-1.1.22-0.rc1.9.9.ia64.rpm ebf3ca248025a33cbb432f3f51dac1f3 cups-devel-1.1.22-0.rc1.9.9.ia64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm d673d6538e126c4374be81bf513000f2 cups-libs-1.1.22-0.rc1.9.9.ia64.rpm x86_64: 8930858f2aa35547ef280ca80b2fbbf1 cups-1.1.22-0.rc1.9.9.x86_64.rpm 1451d04888bb8285c4eff2f39843dcf9 cups-devel-1.1.22-0.rc1.9.9.x86_64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm 0663930f0ad6bb3648c71ab252c7e37d cups-libs-1.1.22-0.rc1.9.9.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/cups-1.1.22-0.rc1.9.9.src.rpm d718800ea8bb89d10541219c418a1e5e cups-1.1.22-0.rc1.9.9.src.rpm i386: f750dba7bddeed26ad1246a13d67b4cc cups-1.1.22-0.rc1.9.9.i386.rpm 75f3d226a45dc479659d3d8a841d92b0 cups-devel-1.1.22-0.rc1.9.9.i386.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm ia64: fce05f1785514904e476428c143cacbf cups-1.1.22-0.rc1.9.9.ia64.rpm ebf3ca248025a33cbb432f3f51dac1f3 cups-devel-1.1.22-0.rc1.9.9.ia64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm d673d6538e126c4374be81bf513000f2 cups-libs-1.1.22-0.rc1.9.9.ia64.rpm x86_64: 8930858f2aa35547ef280ca80b2fbbf1 cups-1.1.22-0.rc1.9.9.x86_64.rpm 1451d04888bb8285c4eff2f39843dcf9 cups-devel-1.1.22-0.rc1.9.9.x86_64.rpm 4b3f8ea8167580e91849649f82c44349 cups-libs-1.1.22-0.rc1.9.9.i386.rpm 0663930f0ad6bb3648c71ab252c7e37d cups-libs-1.1.22-0.rc1.9.9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFDqCFBXlSAg2UNWIIRAtQZAJ0S9fuOETzgC8P1thEnk7L+PGG2IwCfeRIJ MSfcuhoHq7Rhw6Otbjcm2sQ= =SxR3 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBQ6izhyh9+71yA2DNAQJa6QP/Xch98AMAUeS3Qxyq6Oy9j+H3NMu95H3f hvqV+m9kxSwB/LqC04jIrx7O+9Nvdw95yXhOsRrE7JH43/Cd2OHLBuY74pn+mKcQ F5WYNuurtW2XTTz0MfJa2WcsjhupWTjVNg2P+uMXhBXYK1tTPwmvhbkjah3o8AIs r10exQy6zUg= =B7nd -----END PGP SIGNATURE-----