Description
The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | system-config-printer | 1.3.7-1 | — |
| Debian 13 | system-config-printer | 1.3.7-1 | — |
| Debian 12 | system-config-printer | 1.3.7-1 | — |
References
- 46909 third-party-advisory
- 50721 vdb-entry
- systemconfigprinter-packages-mitm(71394) vdb-entry
- 77214 vdb-entry
- USN-1265-1 vendor-advisory