| View previous topic :: View next topic |
| Author |
Message |
michip
n00b
Joined: 17 Oct 2002
Posts: 42
Location: Kassel, DE
|
 Posted: Wed Jan 05, 2005 11:12 am Post subject: Possible CUPS DoS ? |
 |
|
Hi,
I've updated cups to 1.1.23_rc1 as adviced. More accidently (tried to discover potential NFS-bugs) I used nessus to check the machine and recognized a hang of cups with >99% CPU. It was not reachable in any manner (remote, local e.g. lpq) and only killable with -9 .
I was able to reproduce this at least one other machine.
The log is not very helpful, this is the end:
access_log:
| Code: | POST /jobs HTTP/1.1
GET /jobs?-=9%2c+9%2c+9&which_jobs= HTTP/1.1
POST / HTTP/1.1
GET /jobs?-=9%2c+9%2c+9&which_jobs= HTTP/1.1
POST /jobs HTTP/1.1
POST / HTTP/1.1
POST /jobs HTTP/1.1
GET /jobs?-='bad_bad_value&which_jobs= HTTP/1.1
POST / HTTP/1.1
GET /jobs?-='bad_bad_value&which_jobs= HTTP/1.1
GET /scripts/cgimail.exe HTTP/1.1
GET /scripts/logicworks.ini HTTP/1.1
|
error_log: | Code: | E [05/Jan/2005:11:50:55 +0100] get_jobs: resource name '/printers/non-existant-1435013067' no good!
E [05/Jan/2005:11:50:56 +0100] Bad URI "c:\boot.ini" in request!
E [05/Jan/2005:11:51:02 +0100] Bad URI "-" in request!
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=903)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=904)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=905)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=906)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=907)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=908)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=909)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=910)
I [05/Jan/2005:11:51:02 +0100] Started "/usr/lib/cups/cgi-bin/jobs.cgi" (pid=911) |
Any one can reproduce this ?
CU
Michael |
|
| Back to top |
|
 |
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Fri Jan 07, 2005 2:36 pm Post subject: |
|
|
Yes I can.
All I can say for now is it's triggered by HTTP on TCP 631. You should probably restrict access to this port to localhost only.
We are investigating it and will send the issue upstream in case of need.
I'll let you know.
--
Koon
Operational Manager, Gentoo Linux Security |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
|
| Back to top |
|
|
|
Networking & Security
