Looking at the patches for CVE-2012-5519 committed 3rd December 2012 it
seems that the SystemGroup variable was removed from cupsd.conf
configuration but existing entries in cupds.conf were not migrated in
the post-inst scripts.
cups (1.5.3-0ubuntu5.1) precise-security; urgency=low
* SECURITY UPDATE: privilege escalation via config file editing
- debian/patches/CVE-2012-5519.patch: split configuration file into
two, to isolate options that have a security impact.
- debian/cups.install: also install cups-files.conf
- debian/patches/removecvstag.patch: updated to remove tag from
cups-files.conf.
- CVE-2012-5519
** CVE added: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5519
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to cups in Ubuntu.
https://bugs.launchpad.net/bugs/1088448
Title:
Unknown directive SystemGroup
Status in “cups” package in Ubuntu:
Confirmed
Bug description:
Ubuntu 12.04 Precise, /var/log/cups/error_log shows:
E [10/Dec/2012:11:28:56 +0000] Unknown directive SystemGroup on line
16 of /etc/cups/cupsd.conf.
The file contains:
# Administrator user group...
SystemGroup lpadmin
I can find no reference to "SystemGroup" in man 5 cupsd.conf.
$ apt-cache policy cups
cups:
Installed: 1.5.3-0ubuntu5.1
Candidate: 1.5.3-0ubuntu5.1
Version table:
*** 1.5.3-0ubuntu5.1 0
500 http://gb.archive.ubuntu.com/ubuntu/ precise-updates/main amd64
Packages
500 http://security.ubuntu.com/ubuntu/ precise-security/main amd64
Packages
100 /var/lib/dpkg/status
1.5.2-9ubuntu1 0
500 http://gb.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1088448/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : desktop-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
