CVE-2017-18248: Improper Input Validation (CWE-20)
value: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.3
Published: 2018-03-26T17:29Z
Repository: https://github.com/apple/cups
Language: C
Files changed: CHANGES.md, scheduler/ipp.c
Commit date: 2017-10-23 16:23:43 -0400
Commit message: DBUS notifications could crash the scheduler (Issue #5143)

- scheduler/ipp.c: Make sure requesting-user-name string is valid UTF-8.

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 2fdf93e3..86eb1dbd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,14 +1,15 @@
-CHANGES - 2.2.6 - 2017-10-19
+CHANGES - 2.2.6 - 2017-10-23
 ============================
 
 
 Changes in CUPS v2.2.6
 ----------------------
 
+- DBUS notifications could crash the scheduler (Issue #5143)
 - Added USB quirks rules for Canon MP540 and Samsung ML-2160 (Issue #5148)
-- Fixed TLS cipher suite selection with GNU TLS (Issue #5145)
+- Fixed TLS cipher suite selection with GNU TLS (Issue #5145, Issue #5150)
 
 
 Changes in CUPS v2.2.5
 ----------------------
 
diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index e6743cdc..5cf980ab 100644
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -1595,10 +1595,20 @@ add_job(cupsd_client_t  *con,		/* I - Client connection */
     if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
       attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
     return (NULL);
   }
 
+  attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
+
+  if (attr && !ippValidateAttribute(attr))
+  {
+    send_ipp_status(con, IPP_ATTRIBUTES, _("Bad requesting-user-name value: %s"), cupsLastErrorString());
+    if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
+      attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+    return (NULL);
+  }
+
   if ((job = cupsdAddJob(priority, printer->name)) == NULL)
   {
     send_ipp_status(con, IPP_INTERNAL_ERROR,
                     _("Unable to add job for destination \"%s\"."),
 		    printer->name);
@@ -1613,12 +1623,10 @@ add_job(cupsd_client_t  *con,		/* I - Client connection */
   cupsdMarkDirty(CUPSD_DIRTY_JOBS);
 
   add_job_uuid(job);
   apply_printer_defaults(printer, job);
 
-  attr = ippFindAttribute(job->attrs, "requesting-user-name", IPP_TAG_NAME);
-
   if (con->username[0])
   {
     cupsdSetString(&job->username, con->username);
 
     if (attr)

Vulnerable code: CHANGES - 2.2.6 - 2017-10-19
- Fixed TLS cipher suite selection with GNU TLS (Issue #5145)
  attr = ippFindAttribute(job->attrs, "requesting-user-name", IPP_TAG_NAME);

Fixed code: CHANGES - 2.2.6 - 2017-10-23
- DBUS notifications could crash the scheduler (Issue #5143)
- Fixed TLS cipher suite selection with GNU TLS (Issue #5145, Issue #5150)
  attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);

  if (attr && !ippValidateAttribute(attr))
  {
    send_ipp_status(con, IPP_ATTRIBUTES, _("Bad requesting-user-name value: %s"), cupsLastErrorString());
    if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
      attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
    return (NULL);
  }