CVE-2014-3537

What it actually does

The CUPS web interface follows symlinks in the /var/cache/cups/rss/ directory, allowing local lp group members to read contents of arbitrary files on the system.

Why it matters to the business

Users with lp group membership can access sensitive files they shouldn't, potentially exposing configuration or data files, increasing insider threat risks in print server environments.

How an attack unfolds

An attacker with lp group access creates a symbolic link in the RSS cache directory pointing to a target file, then triggers the web interface to read that location, causing it to follow the link and disclose the file contents.

How to fix it

Upgrade CUPS to version 1.7.4 or later across all affected products including Apple CUPS, Ubuntu Linux, and Fedora to disable symlink following in the RSS cache directory.

How to confirm the fix worked

Confirm installed CUPS version is 1.7.4 or newer; attempt to access a known sensitive file via a crafted symlink in the rss cache and verify the interface no longer follows it.

Typical attack path

1. Obtain membership in the lp group on the target system
2. Create a symlink inside /var/cache/cups/rss/ that points to the desired target file
3. Trigger the CUPS web interface RSS functionality to cause symlink traversal
4. Read the resulting file disclosure through the web response

How to detect it

Review CUPS access logs and system audit trails for unexpected file reads by cupsd or related processes; inspect /var/cache/cups/rss/ for recently created symlinks owned by lp group users.

What your security team should do

• Limit lp group membership to only the minimal set of trusted service accounts
• Apply the CUPS 1.7.4 upgrade on all print servers and workstations
• Audit existing symlinks in /var/cache/cups/rss/ and remove any unauthorized links