cups is not compiled with bind-now hardening option
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
cups (Debian) |
Fix Released
|
Unknown
|
|||
cups (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Precise |
Won't Fix
|
Undecided
|
Unassigned | ||
Quantal |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
cups has been compiled with all the hardening options enabled since before ubuntu 10.04; however in the conversion to using the dpkg buildflags mechanism for hardening, the bind-now option was disabled.
To demonstrate, with cups 1.5.2-9ubuntu1 using the hardening-check utility from the hardening-includes package:
$ hardening-check /usr/sbin/cupsd
/usr/sbin/cupsd:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
it should return "Immediate binding: yes".
Please see http://
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: cups 1.5.2-9ubuntu1
ProcVersionSign
Uname: Linux 3.2.0-23-generic x86_64
ApportVersion: 2.0.1-0ubuntu5
Architecture: amd64
CupsErrorLog:
Date: Fri Apr 20 16:06:32 2012
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Beta amd64 (20120418)
Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: No destinations added.
Lsusb:
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 002: ID 80ee:0021 VirtualBox USB Tablet
MachineType: innotek GmbH VirtualBox
Papersize: letter
ProcEnviron:
TERM=screen
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=
SourcePackage: cups
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 12/01/2006
dmi.bios.vendor: innotek GmbH
dmi.bios.version: VirtualBox
dmi.modalias: dmi:bvninnotekG
dmi.product.name: VirtualBox
dmi.product.
dmi.sys.vendor: innotek GmbH
Changed in cups (Debian): | |
status: | Unknown → Fix Released |
Changed in cups (Ubuntu): | |
status: | New → Triaged |
This was also reported in debian bug 662821 where it was fixed in 1.5.2-10; unfortunately only part of the changes from that version made it into the 1.5.2-9ubuntu1 version.