Cups SSL is vulnerable to POODLE

What RH did:
https://rhn.redhat.com/errata/RHBA-2015-1346.html
https://bugzilla.redhat.com/show_bug.cgi?id=1161171
https://bugzilla.redhat.com/show_bug.cgi?id=1161172

Upstream patch - http://pastebin.ubuntu.com/12879503/

Patch in progress for 14.04 http://pastebin.ubuntu.com/12904343/ for some reason fails to fix Poodle on TLS issue.

None of these issues exist in vivid, cups version 2.0.2-1ubuntu3.2. No RC4, No SSLv3, No Poodle on TLS. Would have an A- rating (if it was a valid domain/cert).

Interesting - 14.10 has SSLv3, RC4 issues, but Poodle on TLS is not there (overall grade C). Cups 1.7.5-3ubuntu3.2, libgnutls-deb0-28
vs 14.04 - cups 1.7.2-0ubuntu1.6, libgnutls26

Test fix for 14.04 is available here - http://people.canonical.com/~bryanquigley/cups-1505328

Does anyone need this fix for 12.04?

Made it into a more proper ppa for 14.04 - https://launchpad.net/~bryanquigley/+archive/ubuntu/ppa

I'm thinking it makes sense to do this as a normal (not security update) as it changes the default config.

For 12.04, I haven't seen any demand to backport this.

Related issue for 14.04 - https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/1510163

The attachment "now current debdiff (fixes accidentally included file)" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

1- The debdiff in comment #9 still contains an extra cups-1.7.2/lets_patch_this.patch section. Could you please remove it?
2- Please add an origin tag to the patch that traces back to redhat's 1161172 bug, since I believe that's what you based the backport on

3- Also, I don't think we should do this change:

@@ -4811,7 +4813,10 @@
   if (http->encryption == HTTP_ENCRYPTION_REQUIRED && !http->tls)
   {
     httpSetField(http, HTTP_FIELD_CONNECTION, "Upgrade");
- httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0");
+ if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+ httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0,SSL/3.0");
+ else
+ httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0");
   }
 #endif /* HAVE_SSL */

@@ -5572,7 +5590,10 @@

   httpClearFields(http);
   httpSetField(http, HTTP_FIELD_CONNECTION, "upgrade");
- httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0");
+ if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+ httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0,SSL/3.0");
+ else
+ httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0");

   if ((ret = httpOptions(http, "*")) == 0)
   {

It doesn't make sense to "upgrade" to sslv3.

So, looking at the patch, I believe this should be an SRU, and not a security update.

Also, please add "(LP: #1505328)" to the debian/changelog.

Really fixed extra file, added LP #, and removed "Upgrade to SSLv3" part.

Forgot to mark it fixed in devel (since wily at least)

This part of the patch is wrong:

@@ -895,18 +922,6 @@ _cupsSetDefaults(void)
       * Look for ~/.cups/client.conf...
       */

- snprintf(filename, sizeof(filename), "%s/.cups/client.conf", home);
- fp = cupsFileOpen(filename, "r");
- }
- else
- fp = NULL;
-
- if (!fp)
- {
- /*
- * Look for CUPS_SERVERROOT/client.conf...
- */
-
       snprintf(filename, sizeof(filename), "%s/client.conf",
                cg->cups_serverroot);
       fp = cupsFileOpen(filename, "r");

It is removing the section that reads ~/.cups/client.conf instead of removing the section that reads CUPS_SERVERROOT/client.conf that got moved higher up in the code.

New debdiff with fix for C#15

ACK on the updated debdiff, thanks!

I've changed my mind, and will release it as a security update after all if testing goes well.

Thanks!

This bug was fixed in the package cups - 1.7.2-0ubuntu1.7

---------------
cups (1.7.2-0ubuntu1.7) trusty-security; urgency=medium

  * Disable SSLv3 with option to turn back on.
    - debian/patches/disable-sslv3.patch: AllowSSL3 turns SSLv3
      back on and AllowRC4 turns on just the RC4 cypers. (LP: #1505328)

 -- Bryan Quigley <email address hidden> Tue, 10 Nov 2015 21:08:44 +0000