CVE-2015-1158

What it actually does

The vulnerability is a use-after-free in cupsd's add_job function when processing multiple-value job-originating-host-name IPP attributes, allowing memory corruption that can lead to arbitrary code execution.

Why it matters to the business

Compromise of print servers can enable attackers to run malicious code, potentially disrupting printing services across an organization and providing a foothold for further network access.

How an attack unfolds

An attacker sends a crafted IPP_CREATE_JOB or IPP_PRINT_JOB request containing specially formed multiple-value job-originating-host-name attributes. This triggers incorrect free operations on reference-counted strings, resulting in memory corruption that the attacker leverages to overwrite configuration files and execute arbitrary code.

How to fix it

Upgrade CUPS to version 2.0.3 or later. If immediate upgrade is not possible, restrict network access to the CUPS service and disable remote IPP job submission where feasible.

How to confirm the fix worked

Verify the installed CUPS version is 2.0.3 or newer. Test that malformed IPP requests no longer cause crashes or configuration changes. Review cupsd logs for unexpected job-originating-host-name attribute handling.

Typical attack path

1. Identify exposed CUPS servers listening on port 631
2. Craft and send malicious IPP_CREATE_JOB or IPP_PRINT_JOB requests
3. Trigger use-after-free to corrupt memory and reference-counted strings
4. Overwrite cupsd configuration to achieve code execution
5. Establish persistence or move laterally from the compromised print server

How to detect it

Examine cupsd access and error logs for unusual IPP job creation requests containing repeated job-originating-host-name attributes. Look for unexpected configuration file modifications or crashes in the scheduler process around the time of suspicious print jobs.

• IPP_CREATE_JOB with multiple job-originating-host-name values
• sudden cupsd configuration file changes
• scheduler/ipp.c crash or memory corruption indicators

What your security team should do

• Prioritize patching all CUPS instances to 2.0.3 or later
• Limit exposure of CUPS services to untrusted networks
• Monitor for exploit attempts using available public exploit code
• Audit print server configurations for unauthorized changes