DRAFT - CUPS Software Security Report
CUPS-SSR-1.0
Easy Software Products
Copyright 1997-1999, All Rights Reserved
1 Scope
2 References
3 Local Access Risks
4 Remote Access Risks
A Glossary
GIF89a¯ÿòÌÌÌ™™™fff333ÿÿÿÿÿÿÿÿÿ!ù,¯ÿBþXºÜþ0ÊI«½8ëÍ»ÿ`(Ždižhª2€0p,Ïtmßx®ï
;±Ýíˆndý !¸ ž³wà…MƒƒY~¿{,gÚ\‚äé 
Œ×Ø(tÙî!Ï=Ñ.ûz¯áÑŸ:ì;Ã9qöíÉë]/¿ºÉ¤Et/†'Îþt9ÀØ–ž_ÙÇ\|W•wArö¸Ý2Ô× 
tN°0Tï}¡û‰$!‚yMxî)ˆš‰Ôø@nB°U½ÊwE„§!ŠF H L8B 
c‰;ždŠ-æDVWdг€h±äÚ“P¶%#(4Fiå•Ï\hŠ:Re!\ÒÄ—X^¦%€¥À-$E€Ö/úHŽšlââöÌQX
¸1Nô¯b"œŠüjåÁÂE0…È8ö5GkZ|ÒÁwt„C»ÔQSÇo6ÔÙ[W„$²*Ž+4Pb-8¹P1þ'8"‘ФÄ$ Cyê‘„)>ãŠtè`Ð3‡‹¾z"«rE'Âqfä°Ë 
‘qÂ\|€„Ž¡ôö»%É(.—bڽȀíÉ`{¬EÇ1w’ »[Hß`(B6ö“  
†')ÊRŽÎa[ÃrbC!Tå°Œ 
2Q·ÈHZê#–®üË/àô¯FÝê(Û²% ºXË9öÀbÁ4f.ù-oý™XËB…IÎÒ7¹*@ÃÓŽÍT€hà‘ÌWâ™Ã$f:µyžn†ó†r„'téKv` 
Ç+dª– œ79sò|'=×¢Ìx¶òœÿ„¦œˆeÎ;*à$þ” IÝÆaÏ{–3ŽÅÁ 
P“ÍS[ÙL¨3©òQ7éÆò#ãûô0F×ðsE°t§@‘ØQÜ´´ ©:3ÓRíd ¥*MITnŒ£¨H]ØQÁd 
@òþ—¬rMœŽaO
rë^yÀ·(¸îéêû$uDòrã/a,I.°ÙUÀœb hˆ`¾B ë" 
Ü`HØxȸo1þ[á\8f^æ|\ý‚¢¢zø0(ˆ\ {ƒÄgäÞõ€çâ§Á˜0*\³n¼‹m¶/Äeª±ÿ†ì 
Ç,½DN2€œº+ùÉ|í0L¡Le*ð¸Ã>2ëf,eIPOËÅàr—±”80SAŸcFªatç»ãy¤¸ršçÌ¡5ïoõËsžï|¿8˙Φ¬þ,ï¼èà)ÁÌ;øk¡—†dDpÑòø2¢qfHã!Ë“~ÙŸ-í 
'g:,æ4y?ýäP‹Z›ž#ÏÕ´Î5AK‰k]ûš›ÒKõ¯‡më€õzØÈƫ؎Ý>B{PЪ.6hf]º?©ÌIŽuO„íM‚ÌÇÜcµ3˜ 
61‹NÒ[†W£ ¦m¿{ÂPâvζKnUˆ[ ònĽ±÷n?l:Áž3ušë¬sP[ÿnn¾çP…WõÔFj[Â÷ 
¹vÏ™à‰˜xú'ˆ£ÀÀ†p¸4.êãKÇ¿ÂÁ±o§¢ü"Á|Nk`îʘ
 
jl©ÌuˆËi™0pmC´«+‰÷6¤2éÏe`(ŽJ]¥iõð3ƒØí"p|ª!:qøFس 6£ 
@,þŠqüãoÌÇ®žÖüV“¶QÇ›Evî¹²É8ÙªS"æÀç‡x± àþ‡>—Iãg 
ïÝ>Y‰çN80æ§ ±¾GLLìÕµ…(1Þ¼!8}þ¬“*…ª‰Ùì:e»´œ 
ª¿ên_6ÂÃSÀ`eG;Ö„CƒCcˆ¿‡4¸yeî¯Í)oøByRm½0?íLîÅ`QÿjÓÙ/ºôÓN|Ý
þÙAÜŒÁ¸D5©D aævx ?жx°DM@•!h‰àÈ€Ž§® 
• á×B`ð¤ªE?›“”Þdƒ"8$Ý`Ki0…OðƒnΓ±µvtžè€I([,¹Ndɨh\'6X 
Pã—Š‰Éøt ¢‘¥˜¬è €ˆ†Ky™FˆŒë`š”yƒ„¨š €š‰ƒM©‡øFQhY„ 
9¶X¯×–í4š¤™Y\)"¹AN]‰xéz÷Gq07)©ñ™•Y€r°ŒŽi‹ z ™ÇäFÍÉT–ù› 
ËŽC œwI›üX]‹¹\ëY]þf lïYbj8ŸÈuœbŸÍÅtú©fÞןfBI—“*øé:ÛØUj Ò 
ˆõ¹ Õp $(~  ¡Ú ¡gù{îpZI?¡ƒîÀv:“a¦˜6¢§Ô]Ý‘(ªê)!ŸÚ¢: 
jwµ¡4ÚvíHÛǘ9ºXhó•üù£¥Á¢VÉ{Dº2š‰(°¤3š¤a÷ +У¥“p¢þò4Vº—  
E´¥è¤k°7ºhT*€¿èw`ÚžiÄ …S¦Æ¦mê Nêƒ#ú¢f€ xê†ý 
8z©7uÚp{Ú=~]7`«h‡ÚsÚg:…zd˜ó§ÎA-vþAñr¦'–AÚ)9–š¢âSi;£…š 1ªo"ª 
¦J;“º rº8Ui|é>¡Úœú
“ë¥Dfný2»ƒ–0j«®»ºK;zë¢Íö»—!µ—S»³r>K+6ˆ‹¨XÒ»; CÈ 
8Ê;¢»ÃÛ/Œ‹¥ž!¬s½VR½óõÏ‹Oâ[/çK¨þ˜Ñ:Í‹\Ý+ Sc:ïËž’º¶ë9Æ»
ô 8ly$ 
8©ÙÅmX2Ùh>—?¯!šHüÁ^LsP,Ÿ«Y‹âá¿ÿtšì‚£Y 
r¦Éš¥9ÇjžÄ8-ÆÇŒ¶iêPÂbA˜ù‰Ã¸š»³7RœCWRoìŠå MŒŠ”åt™ Œ›réÉq
å>}Lê}ÎǨ 5:àŒ|"þÇwÐsøæNΰ¹#R>~-N‰®èƒ ßcðÞÚÎÑ¥®åGÎâ툉Ýè*‚¸ 
=‚ž ºëâ…ëÀ>Û·žën^žmèÊëð¼ã>å×Λ«}êØ÷ 
“Œ¬ËIÁ·AÔNÍëv>]t.âÚLЫþíï¾ñnäÖÜæs¹¿±â°+† 
¬UØïî•.ç¬ÎìÍ.è´ÞŠG=ðù‚§ž¯”ë^äÛ®êh-‹êê!i!ÕvMíiªîþ¾òîá/þÑ-OÖGð,oñº!å’gOâ POìOôBþÈàhâ+?ï>ßÊVHÀsaõ™€õ$óSîõ—»ó8.žß¹ 
~áßÈ©ö»]ò3ëÆt_÷[ïôb¯ç‚Ü÷Õ«@u™ð;zܘ‘Ü@óŽ2’?ùƒ¸ÙlùF ¶™¯ù›N ž0œú£¶¤ÿ0#9:ß§½ž©Ÿ\#ÃÙæó2é+û‚ÀÓ¸_äM/ÓtaÚý3”]Ù«¿¸iîaF>ª}ŒØvÍïMÍ÷Ðëä©îrÜŒöqñ_ÀüªrâF®ò
ýþ¸—hT_ã4sx”ýÝî)ç.QgûàŸÏ%ì‹}i´ASû|þð@QÜ 
$J9€»-̱÷ÜôMØ‘hZ˜¦:°œ*ÏlßxÒ|ϼ¡ÅLÀ ¬Áfù9BÑdìÁ|«VV„¢“énKv
kB_ƒg 3ʳ8#Þ¬L=0;J¤äÈ@¤F|'i~±©  žaÊŠÆg;d*3²”©bPÏ¢TäHô¦?[† 
ÄäƒhN6ZM¢D:c*BR!$±ckƒ’V-uÛ@[øp„Ÿ]¼8ö-1{TήWÏ2ñ Šp=¸q«Ñ½es.‰„4+#Ëe¦¥W5µekxr䛓/XÍš5Iǃ=kÝúµì˰ûN–2qÅ[r¦yZ£QŽ›ÇÞtxŠäcK—Ííɹ 
iþ¡9¼m1oñ¢©/²8îìSté4l’Wm¾9óéÖÛÐãã{{üzÞ¿çøêöÞzà}œàL¨ "˜ 
ÄÐsà¶PGLUúå`MÞ  ¡†9¬§Û{pX¸¡wÚw߇¡¨ ‰í "MUXNx
+l´á¦ 
j²F:Á.êÆÛj¤³Búî ¼Ê«/£Ö’[н#í+ð¥ænJÞ¸«æ;ð©õ‹¨ _ËðÄŠÒ»*º? 
ƒÂwœÃyzh±°Øzl2,#oZ2È›r|òË‚°¼$Ç)ë 
óÍÙÔ,éfs€1Î@/øîÏPõÌiÐH·ðÃBkLtÒP¯bôS;NÝWÔXÏ 
ó’dlÍtÖ`°tžOc óÅa§}AÄ›²1vËjÇmþu+`ÍÍÁ·qwü6˜‚ì½sÞXŸ¨Ë$xM6àP³-iÉSÚ½AÙˆïë84–ø=xä8^!ä*L>Þ˜ƒk¹Œ({Iè^!ḘN$ê 
«®ç!ºû‚ÿÝ ë¯ßoî—Oü¨¾ÿî9í]ñÞ{ñÙÊ®ãlhŽ(èÌÃê¼~ÔS¢|öÕŸzýw¬Ë§|øÝ—*½ŒÈ×|úåwzþæ“)Nrû¾Ê?*ô¥ 
¿*÷ô7ú½~Múúú÷ª÷Ɉ•S3x*ûíP”ùH£°°àó(è¾í-Jƒú™ 
åAF{#\”g…Áœ)!),Ô #ÓÂǼjþ1œŒþh©²K„9$ƒYè)Ž ˆA È 
—‡)#1‰Óp"˜ð'Ã%n‰P´‡Ù¨-‹1³¢^\%ƈÔp„CLÖ5Ã
 This software security report provides an analysis of possible 
security concerns for the Common UNIX Printing System ("CUPS") Version 
1.0.
 The Common UNIX Printing System provides a portable printing layer for 
 UNIX® operating systems. It has been developed by Easy Software 
 Products to promote a standard printing solution for all UNIX vendors 
 and users. CUPS provides the System V and Berkeley command-line 
interfaces. 
CUPS uses the Internet Printing Protocol (IETF-IPP) as the basis for 
managing print jobs and queues. The Line Printer Daemon (LPD, RFC1179), 
Server Message Block (SMB), and AppSocket protocols are also supported 
with reduced functionality. 
CUPS adds network printer browsing and PostScript Printer 
Description ("PPD")-based printing options to support real world 
applications under UNIX. 
CUPS also includes a customized version of GNU GhostScript 
(currently based off GNU GhostScript 4.03) and an image file RIP that 
can be used to support non-PostScript printers. 
This software security report is organized into the following 
sections:
- 1 - Scope
- 2 - References
- 3 - Local Access Risks
- 4 - Remote Access Risks
- A - Glossary
The following CUPS documentation is referenced by this document:
- CUPS-CMP-1.0: CUPS Configuration Management Plan 
- CUPS-IDD-1.0: CUPS System Interface Design Description 
- CUPS-SAM-1.0.x: CUPS Software Administrators Manual 
- CUPS-SDD-1.0: CUPS Software Design Description 
- CUPS-SPM-1.0: CUPS Software Programming Manual 
- CUPS-SSR-1.0: CUPS Software Security Report 
- CUPS-STP-1.0: CUPS Software Test Plan 
- CUPS-SUM-1.0.x: CUPS Software Users Manual 
- CUPS-SVD-1.0.x: CUPS Software Version Description 
The following non-CUPS documents are referenced by this document:
- IEEE 1387.4, System Administration: Printing (draft) 
- IPP/1.0: Additional Optional Operations - Set 1 
- RFC 1179, Line Printer Daemon Protocol 
- RFC 2565, IPP/1.0: Encoding and Transport 
- RFC 2566, IPP/1.0: Model and Semantics 
- RFC 2639, IPP/1.0: Implementers Guide 
Local access risks are those that can be exploited only with a local 
user account. This section does not address issues related to 
dissemination of the root password or other security issues associated 
with the UNIX operating system. 
There are two known security vulnerabilities with local access: 
- Since the default installation creates a world-readable  request 
directory, it is possible for local users to read the  contents of 
print files before they are printed. 
This problem can be alleviated by making the request  directory 
readable only by the user specified in the CUPS  configuration file.  
- Device URIs are passed to backend filters in argv[0] and in  an 
environment variable. Since device URIs can contain  usernames and 
passwords it may be possible for a local user to  gain access to a 
remote resource. 
We recommend that any password-protected accounts used for  remote 
printing have limited access priviledges so that the  possible damages 
can be minimized.  The device URI is "sanitized" (the username and password are 
 removed) when sent to an IPP client so that a remote user  cannot 
exploit this vulnerability.  
Remote access risks are those that can be exploited without a local 
user account and/or from a remote system. This section does not address 
issues related to network or firewall security. 
Like all Internet services, the CUPS server is vulnerable to denial 
of service attacks, including: 
- Establishing multiple connections to the server until the server 
 will accept no more. 
This cannot be protected against by the current software. It  is 
possible that future versions of the CUPS software could be  configured 
to limit the number of connections allowed from a  single host, however 
that still would not prevent a determined  attack.  
- Repeatedly opening and closing connections to the server as fast 
 as possible. 
There is no easy way of protecting against this in the CUPS 
 software. If the attack is coming from outside the local  network it 
might be possible to filter such an attack, however  once the 
connection request has been received by the server it  must at least 
accept the connection to find out who is  connecting.  
- Flooding the network with broadcast packets on port 631. 
It might be possible to disable browsing if this condition  is 
detected by the CUPS software, however if there are large  numbers of 
printers available on the network such an algorithm  might think that 
an attack was occurring when instead a valid  update was being 
received.  
- Sending partial IPP requests; specifically, sending part of an 
 attribute value and then stopping transmission. 
The current code is structured to read and write the IPP  request 
data on-the-fly, so there is no easy way to protect  against this for 
large attribute values.  
- Sending large/long print jobs to printers, preventing other users 
 from printing. 
There are limited facilities for protecting against large print 
 jobs (the MaxRequestSizeattribute), however this will 
 not protect printers from malicious users and print files that 
 generate hundreds or thousands of pages. In general, we recommend 
 restricting printer access to known hosts or networks, and adding 
 user-level access control as needed for expensive printers.
 
The current CUPS server only supports Basic authentication with 
usernames and passwords. This essentially places the clear text of the 
username and password on the network. Since CUPS uses the UNIX username 
and password account information, the authentication information could 
be used to gain access to accounts (possibly priviledged accounts) on 
the server. 
The default CUPS configuration disables remote administration. We do 
not recommend that remote administration be enabled for all hosts, 
however if you have a trusted network or subnet access can be 
restricted accordingly. 
The next minor release of CUPS will support Digest authentication of 
the entire message body using separate MD5-based username and password 
files. This will protect password information and prevent unauthorized 
access due to compromised account passwords. 
- C 
- A computer language. 
- parallel 
- Sending or receiving data more than 1 bit at a time. 
- pipe 
- A one-way communications channel between two programs. 
- serial 
- Sending or receiving data 1 bit at a time. 
- socket 
- A two-way network communications channel. 
- ASCII 
- American Standard Code for Information Interchange 
- CUPS 
- Common UNIX Printing System 
- ESC/P 
- EPSON Standard Code for Printers 
- FTP 
- File Transfer Protocol 
- HP-GL 
- Hewlett-Packard Graphics Language 
- HP-PCL 
- Hewlett-Packard Printer Control Language 
- HP-PJL 
- Hewlett-Packard Printer Job Language 
- IETF 
- Internet Engineering Task Force 
- IPP 
- Internet Printing Protocol 
- ISO 
- International Standards Organization 
- LPD 
- Line Printer Daemon 
- MIME 
- Multimedia Internet Mail Exchange 
- PCL 
- Page Control Language 
- PPD 
- PostScript Printer Description 
- SMB 
- Server Message Block 
- TFTP 
- Trivial File Transfer Protocol