--------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated CUPS packages fix security issue Advisory ID: FLSA:163274 Issue date: 2005-09-14 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CAN-2005-2154 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: Updated CUPS packages that fix a security issue are now available. The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: When processing a request, the CUPS scheduler would use case-sensitive matching on the queue name to decide which authorization policy should be used. However, queue names are not case-sensitive. An unauthorized user could print to a password-protected queue without needing a password. The Common Vulnerabilities and Exposures project has assigned the name CAN-2005-2154 to this issue. All users of CUPS should upgrade to these erratum packages which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163274 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/cups-1.1.14-15.4.5.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/cups-1.1.14-15.4.5.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/cups-devel-1.1.14-15.4.5.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/cups-libs-1.1.14-15.4.5.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/cups-1.1.17-13.3.0.14.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/cups-1.1.17-13.3.0.14.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cups-devel-1.1.17-13.3.0.14.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cups-libs-1.1.17-13.3.0.14.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/cups-1.1.19-13.9.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/cups-1.1.19-13.9.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/cups-devel-1.1.19-13.9.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/cups-libs-1.1.19-13.9.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/cups-1.1.20-11.11.2.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/cups-1.1.20-11.11.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/cups-devel-1.1.20-11.11.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/cups-libs-1.1.20-11.11.2.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 0c703164c4314cc91e31a859ed8e149e4249bd68 redhat/7.3/updates/i386/cups-1.1.14-15.4.5.legacy.i386.rpm 62414dc09ab8e240f92fe476dc272d227ba223ce redhat/7.3/updates/i386/cups-devel-1.1.14-15.4.5.legacy.i386.rpm 4bce41d4c0323700d3a78adf21bb3ff0790cbe44 redhat/7.3/updates/i386/cups-libs-1.1.14-15.4.5.legacy.i386.rpm 2fa58515d46929fe6116c8c72e50c26b8313c504 redhat/7.3/updates/SRPMS/cups-1.1.14-15.4.5.legacy.src.rpm 4d6585d937c4855c8d999bc292d17e13258d5cb5 redhat/9/updates/i386/cups-1.1.17-13.3.0.14.legacy.i386.rpm 445a0332fff4b09cd2c4f8d7643fb12213498608 redhat/9/updates/i386/cups-devel-1.1.17-13.3.0.14.legacy.i386.rpm d65b045173aba91de7fa2d44217ba6d939a775a3 redhat/9/updates/i386/cups-libs-1.1.17-13.3.0.14.legacy.i386.rpm 35bf3fdafd340588d4c8f167709d53bcc2eb6ff4 redhat/9/updates/SRPMS/cups-1.1.17-13.3.0.14.legacy.src.rpm 97265e88f58dde6d0a9956ef9de0fce61c256077 fedora/1/updates/i386/cups-1.1.19-13.9.legacy.i386.rpm cb73c7d7e91cff10fab3c11a63dbcb002f1242d9 fedora/1/updates/i386/cups-devel-1.1.19-13.9.legacy.i386.rpm d3ae92680bbadfa11ce5f0c92c8243950e92d441 fedora/1/updates/i386/cups-libs-1.1.19-13.9.legacy.i386.rpm 244deb8d82130ecc23e143574cee05bda29d9e7c fedora/1/updates/SRPMS/cups-1.1.19-13.9.legacy.src.rpm 1973c00db116e6f20afb96acfc3f98d240ac1b1e fedora/2/updates/i386/cups-1.1.20-11.11.2.legacy.i386.rpm 0a6c53922499dc4a5917e25660478c25921752a7 fedora/2/updates/i386/cups-devel-1.1.20-11.11.2.legacy.i386.rpm 5989d3bc71592333e6dba34d37b2251e776b7318 fedora/2/updates/i386/cups-libs-1.1.20-11.11.2.legacy.i386.rpm e3fd4d455daaee834ab6b1888454b082a56d52ea fedora/2/updates/SRPMS/cups-1.1.20-11.11.2.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2154 9. Contact: The Fedora Legacy security contact is <secnotice@xxxxxxxxxxxxxxxx>. More project details at http://www.fedoralegacy.org ---------------------------------------------------------------------
Attachment:
signature.asc
Description: OpenPGP digital signature