Fix weak session-cookie RNG fallback in cgi_set_sid()

[mounichalla06]

Summary

cgi_set_sid() in cgi-bin/var.c builds the CUPS web-admin session ID (CUPS_SID cookie) from 8 bytes pulled via the legacy CUPS_RAND() macro, seeded once via CUPS_SRAND(curtime.tv_sec + curtime.tv_usec) -- wall-clock time at microsecond resolution.

CUPS_RAND/CUPS_SRAND are defined by a compile-time fallback chain in config.h:

#ifdef HAVE_ARC4RANDOM
#  define CUPS_RAND() arc4random()
#  define CUPS_SRAND(v)
#elif defined(HAVE_RANDOM)
#  define CUPS_RAND() random()
#  define CUPS_SRAND(v) srandom(v)
#elif defined(HAVE_LRAND48)
#  define CUPS_RAND() lrand48()
#  define CUPS_SRAND(v) srand48(v)
#else
#  define CUPS_RAND() rand()
#  define CUPS_SRAND(v) srand(v)
#endif

HAVE_ARC4RANDOM is only defined when ./configure detects a native arc4random(). When it's absent the session ID collapses to random()/lrand48()/rand() seeded only from wall-clock time -- an attacker who can bound the request time (e.g. from the response's own Date: header) can brute-force the seed space and regenerate the session cookie.

This isn't a narrow edge case: the pre-generated Windows build config (vcnet/config.h) has HAVE_ARC4RANDOM, HAVE_RANDOM, and HAVE_LRAND48 all undefined, so Windows builds always land on the weakest link in the chain, rand()/srand().

This was originally reported via Google (Project Zero issue tracker, bug 42450776, going back to the CVE-2018-4700 era); the same code path flagged there is still present verbatim at current master.

Fix

cups/rand.c already ships cupsGetRand(), a proper cross-platform CSPRNG for exactly this purpose:

• Windows: rand_s() (real OS entropy)
• macOS/iOS: arc4random()
• other Unix: Mersenne Twister seeded from /dev/urandom

It's already used elsewhere in this codebase for other security-sensitive randomness -- HTTP digest-auth nonces (http-support.c) and OAuth state bytes (oauth.c). This PR makes cgi_set_sid() use the same facility instead of rolling its own weaker randomness via CUPS_RAND()/CUPS_SRAND(), and drops the now-unused gettimeofday()/curtime seeding. Net -1 line, no new dependencies.

Test plan

• Fresh clone of current master, ./configure --disable-shared succeeds
• make -C cups libcups.a builds clean
• make -C cgi-bin all -- var.c (the only file touched) compiles with zero warnings/errors for both arm64 and x86_64 slices and archives successfully into libcupscgi.a
• Not independently verified against a live, production cupsd web-admin instance with real attacker-side cookie brute-forcing -- this is a static-analysis-driven hardening fix, not an exploit-verified PoC

AI-assisted analysis and patch authored with assistance from Claude (Anthropic).

🤖 Generated with Claude Code

[michaelrsweet]

Don't need the editorial about not using CUPS_RAND or the advantages of cupsGetRand.

But honestly you are overblowing the risk - the seed is microseconds and you can't send requests fast enough to successfully attack the CGI programs, and a "smart" attacker would just GET a CGI page and harvest the SID...

[mounichalla06]

Thanks — dropped the comment and trimmed to just the cupsGetRand() swap. Agreed the practical risk is low (microsecond seed, SID is observable anyway); not claiming an exploit, just a consistency fix to use the same CSPRNG already used for digest nonces / OAuth state. Happy to close if you'd rather not take it.

[michaelrsweet]

I'm fine taking it with the changes. Thanks!