CVE-2014-5029

What it actually does

Local symlink attack in the CUPS web interface allowing lp group users to read arbitrary files by targeting /var/cache/cups/rss/ with language[0] set to null.

Why it matters to the business

Users with lp group membership can access sensitive files on the print server, risking exposure of system configuration or data without requiring network access.

How an attack unfolds

An attacker with lp group membership creates a symlink in the CUPS RSS cache directory pointing to a target file, then accesses the web interface and supplies a null language parameter to force the server to follow the symlink and disclose the file contents.

How to fix it

Upgrade CUPS to a version newer than 1.7.4 that fully resolves the symlink handling issue, restrict membership in the lp group to trusted accounts only, and disable or harden the web interface if not required.

How to confirm the fix worked

Verify installed CUPS version is newer than 1.7.4, confirm absence of world-writable cache directories, and test that language parameter manipulation no longer permits file disclosure via symlinks.

Typical attack path

1. Obtain or assume membership in the lp group on the target system
2. Create a symlink in /var/cache/cups/rss/ pointing to the desired file
3. Submit a request to the CUPS web interface with language[0] set to null
4. Read the disclosed file contents returned by the server

How to detect it

Search web server and CUPS logs for requests containing language[0] set to null, inspect /var/cache/cups/rss/ for unexpected symlinks, and review file access timestamps on sensitive targets.

• /var/cache/cups/rss/
• language[0]=
• symlink.*cups

What your security team should do

• Immediately audit and minimize membership in the lp group
• Upgrade CUPS on all affected systems to a patched release
• Disable the CUPS web interface unless explicitly needed
• Monitor for changes to files under /var/cache/cups/rss/