This script is Copyright (C) 2010-2014 Tenable Network Security, Inc.
The remote printer service is affected by multiple vulnerabilities.
According to its banner, the version of CUPS installed on the remote
host is earlier than 1.4.3. Such versions are affected by several
- A pointer use-after-free vulnerability exists in the
abstract file descriptor handling code in the
'cupsdDoSelect' function in scheduler/select.c. A remote
attacker may be able to leverage this to hang or crash
the cupsd daemon by disconnecting while receiving a
listing with a large number of print jobs. (STR #3200)
- The lppasswd utility, when its setuid bit is enabled,
allowing a local user to elevaate privileges because it
uses an environment variable to override CUPS' default
directories and determine the location of a file with
localized message strings. (STR #3482)
See also :
Upgrade to CUPS version 1.4.3 or later.
Risk factor :
High / CVSS Base Score : 7.2
CVSS Temporal Score : 6.0
Public Exploit Available : true
Nessus Plugin ID: 45554 (cups_1_4_3.nasl)
Bugtraq ID: 3704838524
CVE ID: CVE-2009-3553CVE-2010-0393
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.